ci: enable security-and-quality CodeQL query #1960

	name: scan

	on:
	push:
	branches: [ main ]
	pull_request:
	branches: [ main ]
	schedule:
	- cron: '18 10 * * 3'

	permissions:
	security-events: write
	actions: read
	contents: read

	jobs:
	codeql:
	name: CodeQL
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
	- name: Setup Go
	uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
	with:
	go-version: 1.20.x
	cache-dependency-path: \|
	**/go.sum
	**/go.mod
	- name: Initialize CodeQL
	uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
	with:
	languages: go
	# xref: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
	# xref: https://codeql.github.com/codeql-query-help/go/
	queries: security-and-quality
	- name: Build
	run: \|
	run_codeql_build() {
	go_mod_file="$1"
	echo "Downloading Go Modules in ${go_mod_file%/*}"
	cd "${go_mod_file%/*}"
	go mod tidy
	${CODEQL_EXTRACTOR_GO_ROOT}/tools/${CODEQL_PLATFORM}/go-extractor ./...
	}
	export -f run_codeql_build

	# Find all go.mod files and execute the command in parallel
	find . -type f -name "go.mod" -print0 \| parallel -0 -n1 bash -c 'run_codeql_build "$@"' _
	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4

Provide feedback