Add CodeQL security scanning

[jhutchings1]

Hi, I'm a PM on the GitHub security team. This repository is eligible to try the new GitHub Advanced Security code scanning beta.

Code scanning runs a static analysis tool called CodeQL which scans your code at build time to find any potential security issues. We've tuned the set of queries to be only the most severe, most precise issues. We'll show alerts in the security tab, and we'll show alerts for any net new vulnerabilities on pull requests as well. We've tried to make this super developer friendly, but we'd love your feedback as we work through the beta.

If you're interested in trying it out, you can merge this pull request to set up the Actions workflow.

[jhutchings1]

The build is working in my fork, so I think this should be good if you're happy to merge it!

[TylerLeonhardt]

Thanks for this @jhutchings1! Is CodeQL ready for .NET? We would love to add this to the language server for our extension: https://github.com/PowerShell/PowerShellEditorServices

[jhutchings1]

@TylerLeonhardt Yep! Sometimes you have to fuss with the build definition to get it building properly, but we absolutely support C#. If you've got write permissions on that project (or any other PowerShell project), you can set it up like this: https://help.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning.

[TylerLeonhardt]

Nice - we'll look at adding it to our repos.

One more question, @jhutchings1. PowerShell is used all over GitHub, and notice it's not supported in CodeQL. What's the process for requesting/adding another language?

[jhutchings1]

One more question, @jhutchings1. PowerShell is used all over GitHub, and notice it's not supported in CodeQL. What's the process for requesting/adding another language?

We track the overall language adoption across GitHub to prioritize new programming language support. PowerShell isn't on the short-term roadmap, but I'm tagging my colleague @sj who runs our language support as an fyi :)