build: add codeql scan

.github/workflows/ci.yaml

@@ -1,4 +1,4 @@
-name: CI
+name: CI
 
 on:
   pull_request:
@@ -15,18 +15,41 @@ jobs:
     #container: mcr.microsoft.com/dotnet/aspnet:7.0
     #env:
     #  USERPROFILE: "./"
+    permissions:
+      security-events: write
+      actions: read
     steps:
       - uses: actions/checkout@v3
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        # Override language selection by uncommenting this and choosing your languages
+        # with:
+        #   languages: go, javascript, csharp, python, cpp, java
       - name: Setup .NET Core SDK 7
         uses: actions/setup-dotnet@v3
         with:
           dotnet-version: 7
       - name: Install dependencies
         run: dotnet restore
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+        # Command-line programs to run using the OS shell.
+        # https://git.io/JvXDl
+        # If the Autobuild fails above, remove it and uncomment the following three lines
+        #    and modify them (or add more) to build your code if your project
+        #    uses a compiled language
+
+        #- run: |
+        #   make bootstrap
+        #   make release
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
       - name: Build
         run: dotnet build --configuration Release --no-restore
       - name: Test
         run: dotnet test --no-restore --verbosity normal
+
       # dotnet 7 has builtin docker target support using Microsoft.NET.Build.Containers package
       - name: Publish
         run: dotnet publish ./WebApi/WebApi.csproj --no-restore -c Release -o ./dist