setup ossf scorecard and codql workflows

[mmorel-35]

Signed-off-by: Matthieu MOREL matthieu.morel35@gmail.com

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[mmorel-35]

cc @phlax ,
Noticed that there is a formatter for the yaml files.

[phlax]

@mmorel-35 thanks - same style nits - indents/ordering etc - but otherwise lgtm

[phlax]

Noticed that there is a formatter for the yaml files.

yeah yamllint - we wrap it with envoy.code.check - would be good to add that and glint to all of the repos (maintainers willing) as we did in toolshed

https://github.com/envoyproxy/toolshed/blob/fa87bda6b7edd8e426fded6587b5e773e45a026e/.github/workflows/ci.yml#L54-L63

[mmorel-35]

@phlax would it be a lack of rights that explains the failure ?

[phlax]

seems there are 2 issues - the build issue looks a lot to me like a network transient

not sure about pre-commit issue but it seems to have gone away in last push

[phlax]

i dont think it can be permissions as such - its a pull_request trigger which is ~permissionless

[mmorel-35]

OK ! Everything seems to work now.
Anything to add to merge this ?

[phlax]

could you fix the indents please - othewise lgtm

cc @ysawa0 @mattklein123 would be good to get signoff from a repo maintainer

[mmorel-35]

"Fixing" the indent means changing the way it is actually done. It seems out of the scope of this PR.
Can it be done in another PR ?

[ysawa0]

So moving forward we should always ref a sha for images and such?

[phlax]

yeah its generally preferable - but probs we can let dependabot or similar take care of it

[ysawa0]

This looks great, thank you.