Sigspm 11700 add codeql

.circleci/config.yml

@@ -2,13 +2,6 @@ version: 2.1
 
 orbs:
   blackduck: signavio/[email protected]
-  fortify: signavio/[email protected]
-
-executors:
-  fortify:
-    machine:
-      image: &ubuntu "ubuntu-2204:current"
-    resource_class: 2xlarge
 
 references:
   workspace_root: &workspace_root /home/circleci/repo
@@ -77,41 +70,6 @@ jobs:
           blackduck-project-name: i18n
           blackduck-project-path: *workspace_root
 
-  fortify-translate-and-scan:
-    executor: fortify
-    working_directory: *workspace_root
-    steps:
-      - checkout
-      - fortify/setup
-      - run:
-          name: Translate i18n
-          command: |
-            set -x
-            sourceanalyzer \
-              -b i18n \
-              -verbose \
-              ./src
-      - run:
-          name: Analyze i18n
-          command: |
-            sourceanalyzer \
-              -b i18n \
-              -verbose \
-              -scan \
-              -f i18n.fpr
-      - store_artifacts:
-          path: i18n.fpr
-      - run:
-          name: 'Fortify: upload'
-          command: |
-            fortifyclient \
-               -url "$FORTIFY_SSC" \
-               -authtoken "$SSC_API_TOKEN" \
-               uploadFPR \
-               -file i18n.fpr \
-               -project signavio-i18n \
-               -version master
-
   test:
     <<: *container_config
 
@@ -194,15 +152,3 @@ workflows:
     jobs:
       - black-duck-scan:
           context: BlackDuck
-
-  fortify-workflow:
-    triggers:
-      - schedule:
-          cron: '0 0 * * 0'
-          filters:
-            branches:
-              only: master
-    jobs:
-      - fortify-translate-and-scan:
-          context:
-            - fortify

.github/workflows/codeql.yml

@@ -0,0 +1,56 @@
+name: 'CodeQL'
+
+on:
+  push:
+    branches: ['master']
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ['master']
+  schedule:
+    - cron: '30 12 * * 5'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: 'ubuntu-latest'
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['javascript']
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: signavio/codeql-action/init@v2
+        with:
+          queries: security-extended
+          # run an 'alert-suppression' query
+          packs: 'codeql/${{ matrix.language }}-queries:AlertSuppression.ql'
+          languages: ${{ matrix.language }}
+
+      - name: auto-build
+        uses: signavio/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        id: analyze
+        uses: signavio/codeql-action/analyze@v2
+        with:
+          category: '/language:${{matrix.language}}'
+          output: sarif-results
+
+      - name: Dismiss alerts
+        if: github.ref == 'refs/heads/main'
+        uses: advanced-security/dismiss-alerts@v1
+        with:
+          sarif-id: ${{ steps.analyze.outputs.sarif-id }}
+          sarif-file: sarif-results/${{ matrix.language }}.sarif
+        env:
+          GITHUB_TOKEN: ${{ github.token }}