add code scanning

.github/workflows/cve-scanning.yml

@@ -0,0 +1,37 @@
+name: CVE Scanning
+on:
+  push:
+
+jobs:
+  node-modules-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Set up Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: 18
+      - name: Build project with NPM
+        run: npm install --omit=dev
+        working-directory: .
+      - name: Depcheck
+        uses: dependency-check/Dependency-Check_Action@1b5d19fd4a32ff0ff982e8c9d8e27dbf7ac8a46c
+        id: Depcheck
+        with:
+          project: 'legend-engine-ide-vscode'
+          path: '.'
+          format: 'HTML'
+          out: 'reports'
+          args: >
+            --suppression allow-list.xml
+            --nodeAuditSkipDevDependencies
+            --nodePackageSkipDevDependencies
+            --failOnCVSS 7
+            --enableRetired
+      - name: Upload Test results
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: Depcheck report
+          path: ${{ github.workspace }}/reports

.github/workflows/license-scanning.yml

@@ -0,0 +1,30 @@
+name: License Scanning
+
+on:
+  schedule:
+    - cron: '0 8,18 * * 1-5'
+  push:
+    paths:
+      - 'package-json.lock'
+      - 'package.json'
+      - '.github/workflows/license-scanning.yml'
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [16.x]
+    steps:
+      - uses: actions/checkout@v3
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: npm ci --prod
+#       - run: yarn install --production --frozen-lockfile
+        working-directory: .
+      - run: npm install -g node-license-validator
+        working-directory: .
+      - run: node-license-validator . --allow-licenses Apache-2.0 MIT BSD-2-Clause BSD BSD-3-Clause Unlicense
+        working-directory: .

allow-list.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+</suppressions>