Add: [Actions] Security and quality analysis on push / pull-request

.github/workflows/testing.yml

@@ -7,6 +7,36 @@ on:
   pull_request:
 
 jobs:
+  codeql:
+    name: Security and Quality
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v2
+      with:
+        # Must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head of the pull request.
+        fetch-depth: 2
+    # If this run was triggered by a pull request event then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+    - name: Set up Python 3.8
+      uses: actions/setup-python@v1
+      with:
+        python-version: 3.8
+    - name: Install dependencies
+      run: python -m pip install -r requirements.txt
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+      with:
+        languages: python
+        queries: security-and-quality
+    - run: |
+        cat /opt/hostedtoolcache/CodeQL/0.0.0-20200826/x64/codeql/python/tools/python_tracer.py
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1
+
   docker:
     name: Docker build
     runs-on: ubuntu-latest