Create codeql.yml (#129)

.github/workflows/codeql.yml

@@ -0,0 +1,95 @@
+name: 'CodeQL'
+
+on:
+  push:
+    branches: ['develop', 'master']
+  pull_request:
+    branches: ['develop']
+  schedule:
+    - cron: '0 6 * * 1'
+
+env:
+  NODE_VERSION: 16
+  PYTHON_VERSION: 3.12
+  OPENSHOCK_API_DOMAIN: api.shocklink.net
+  # OPENSHOCK_FW_VERSION:
+  #   - If this is branch "master" or "develop", we use "0.0.0-master" or "0.0.0-develop" respectively.
+  #   - All other scenarios we use "0.0.0-unknown", as we cannot guarantee SemVer compliance by accepting any branch name. So this is the safe option.
+  OPENSHOCK_FW_VERSION: ${{ (contains(fromJSON('["master","develop"]'), github.ref_name) && format('0.0.0-{0}', github.ref_name)) || '0.0.0-unknown' }}
+  OPENSHOCK_FW_COMMIT: ${{ github.sha }}
+
+jobs:
+  get-targets:
+    uses: ./.github/workflows/get-targets.yml
+
+  analyze-js-py:
+    name: Analyze JS/PY
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 360
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['javascript-typescript', 'python']
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      # Build stuff here
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: '/language:${{matrix.language}}'
+
+  analyze-cpp:
+    name: Analyze C/C++
+    runs-on: 'ubuntu-latest'
+    needs: [get-targets]
+    timeout-minutes: 360
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    env:
+      language: 'c-cpp'
+
+    strategy:
+      fail-fast: false
+      matrix:
+        board: ${{ fromJson(needs.get-targets.outputs.board-array) }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ env.language }}
+
+      - uses: ./.github/actions/build-firmware
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          board: ${{ matrix.board }}
+          skip-checkout: true
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: '/language:${{ env.language }}'