Create codeql-analysis.yml

[mutazawadorg]

Signed-off-by: Mutaz Awad 107792133+mutazawadorg@users.noreply.github.com

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[emoral435]

Documentation for CodeQL seems to indicate that it can check files that are a combination of javascript and typescript. Since our codebase has a good mix of the both, and we are slowly migrating more towards typescript, might as well check for both ⚡

Documentation: https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql#about-codeql

Suggested change

	language: [ 'javascript' ]
	# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
	# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
	language: [ 'javascript-typescript' ]
	# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]

[susnux]

Would not a npm ci && npm run build be less error prone?

[coliff]

That isn't necessary for CodeQL Analysis. Autobuild is only needed for compiled languages:
https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages