.github: scan JavaScript code with codeql

[jelly]

This still has plenty of issues but I think it's time to start scanning

• Tons of false positives in test/ which are used from Python
• kdump needs some major re-factoring to make it more sane. I've fixed the state issues in a branch but I think it's more worthwhile to fix it in general
• Some interesting related issues which require investigation.

[martinpitt]

What's your goal here? One approach would be to ignore all current 70 issues to avoid introducing new ones, but if we are honest, we'll just never fix them then. Once we waive them away (which we need to to get green), they will be really hard to find again.

So I'd rather do a different approach: Go over them once, fix the trivial stuff, and then change the codeql scan to only look at / fail on the 20 security alerts -- then fix/waive these (I think you said there are a lot of false positives?). Then we can fix the 12 warnings and 38 notes in separate steps.

[jelly]

What's your goal here? One approach would be to ignore all current 70 issues to avoid introducing new ones, but if we are honest, we'll just never fix them then. Once we waive them away (which we need to to get green), they will be really hard to find again.

Yes, you are probably right here, once we ignore there is no way back.

So I'd rather do a different approach: Go over them once, fix the trivial stuff, and then change the codeql scan to only look at / fail on the 20 security alerts -- then fix/waive these (I think you said there are a lot of false positives?). Then we can fix the 12 warnings and 38 notes in separate steps.

I think I figured most trivial stuff.

I've went through and marked all the test related things as non-applicable. The rest needs more investigation.

[jelly]

This should be re-run as kdump was fixed.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[jelly]

@martinpitt ok, there are now ~ 8 issues left of which I am unsure how to fix. So shall we merge it and then sort those out?

[martinpitt]

Sure, sounds good! At least we'll prevent introducing new errors then.