Bring Static Code Analysis Tool into CI

[cmwylie19]

Is your feature request related to a problem? Please describe.

A static code analysis tool could alert us quicker on things that circular dependencies, syntax errors, code quality, and best practices.

Describe the solution you'd like

• Given a PR is pushed
• When CI runs
• Then analysis occurs

Describe alternatives you've considered

(optional) A clear and concise description of any alternative solutions or features you've considered.

Additional context

Add any other context or screenshots about the feature request here.

[samayer12]

Internal blog post about running SAST locally. Mention of CodeQL and SemGrep.

We already use CodeQL, maybe we can revisit the configuration. Grype does vulnerability scanning for us.

[samayer12]

This points to a broader organization topic about what tooling belongs across common CI/CD pipelines. Coda page here and a slack thread here.

I'll opt for some of the low-hanging fruit while we figure out broader policies.

[samayer12]

Security scanning:

• GitHub Security scanning requires action by an org owner.