chore(ci): scan GitHub actions using CodeQL (#61)

* chore(ci): scan GitHub actions using CodeQL

New CodeQL feature! It now scans Actions and Workflows.

J:DEF-160

.github/workflows/actions-codeql.yml

@@ -0,0 +1,42 @@
+name: "CodeQL (Actions)"
+
+on:
+  workflow_call:
+    inputs:
+      runs-on:
+        description: |
+          The type of machine to run the job on. Must be provided as a stringified list (e.g. public repos should specify `runs-on: '["ubuntu-latest"]'`)
+        default: '["coveo", "arm64" , "linux", "eks"]'
+        type: string
+
+permissions: { }
+
+jobs:
+  analyze-actions:
+    name: Analyze Actions
+
+    runs-on: ${{ fromJson(inputs.runs-on) }}
+
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/[email protected]
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          languages: actions
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          category: "/language:actions"

.github/workflows/dependency-review-v2.yml

@@ -62,16 +62,16 @@ jobs:
           egress-policy: audit
 
       - name: Checkout scan target
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/[email protected]
 
       - name: Checkout licenses
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/[email protected]
         with:
           repository: coveo/dependency-allowed-licenses
           path: coveo-dependency-allowed-licenses
 
       - name: Get Properties
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/[email protected]
         id: get-properties
         with:
           script: |
@@ -100,7 +100,7 @@ jobs:
 
       - name: Select configuration
         id: select-config
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/[email protected]
         with:
           result-encoding: string
           script: |

.github/workflows/dependency-review.yml

@@ -68,17 +68,17 @@ jobs:
           egress-policy: audit
 
       - name: Checkout scan target
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/[email protected]
 
       - name: Checkout licenses
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/[email protected]
         with:
           repository: coveo/dependency-allowed-licenses
           path: coveo-dependency-allowed-licenses
 
       - name: Select configuration
         id: select-config
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/[email protected]
         env:
           INPUTS: ${{ toJSON(inputs) }}
         with:

.github/workflows/java-maven-openjdk-codeql.yml

@@ -56,15 +56,15 @@ jobs:
       - run: echo "HOME=/root" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/[email protected]
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
         with:
           languages: java
 
       - name: Cache maven dependencies
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/[email protected]
         with:
           path: ~/.m2
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

.github/workflows/java-maven-openjdk-dependency-submission.yml

@@ -55,10 +55,10 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/[email protected]
 
       - name: Cache maven dependencies
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/[email protected]
         with:
           path: ~/.m2
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

.github/workflows/scorecard.yml

@@ -47,7 +47,7 @@ jobs:
             www.bestpractices.dev:443
 
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@v4.2.2
         with:
           persist-credentials: false
 
@@ -74,7 +74,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        uses: actions/upload-artifact@v4.5.0
         with:
           name: SARIF file
           path: results.sarif

.github/workflows/test-actions-codeql.yml

@@ -0,0 +1,21 @@
+name: Test CodeQL for Actions
+
+on:
+  pull_request:
+
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  test:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    uses: ./.github/workflows/actions-codeql.yml
+    with:
+      runs-on: '["ubuntu-latest"]'