Create codeql-analysis.yml

[jfcg]

Add Github CodeQL security checks for Go.

[CLAassistant]

All committers have signed the CLA.

[jfcg]

Btw in my fork under /security/code-scanning I see:

You can see merge scan results here

[na--]

@jfcg, thanks for submitting this PR and sorry for the delay in responding! 😞 We are still unsure if we'd like to integrate CodeQL, since we already have extensive linter coverage for our Go code via golangci-lint. Besides, most of the results from this scan I can see are false-positives in our JS examples, for example:
https://github.com/k6io/k6/blob/47a0b493cce0020d445a47edbca79c25ab5a550f/cmd/testdata/example.js#L81
https://github.com/k6io/k6/blob/47a0b493cce0020d445a47edbca79c25ab5a550f/samples/graphql.js#L4

So, before we can merge this, it will have to be configured to check only Go code, not JavaScript... Though the 2 Incomplete regular expression for hostnames issues in our Go code that were caught are valid and golangci-lint doesn't seem to be able to catch them, so there is some value in this service 🎉

[jfcg]

simplified the codeql file, includes only Go checks

[na--]

Thanks! Why did you remove the pull_request build trigger?

[jfcg]

Thanks! Why did you remove the pull_request build trigger?

Analysis takes some time and most projects I have contributed CodeQL patches/configurations preferred only on pushes. This is the leanest codeql configuration, but of course if you prefer they can also be added.

[na--]

Sorry for the delay here, I forgot to circle back and merge this 😞