ci: replace snyk remnant by codeql (#1304)

<!-- For Coveo Employees only. Fill this section.

CDX-1346

-->

## Proposed changes

- Finish the shift-left move for SAST (CodeQL) & SCA (Dependabot & co)
- Remove the shift right gates & Snyk

.github/workflows/codeql-analysis.yml

@@ -1,28 +1,21 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
 name: 'CodeQL'
 
 on:
   push:
     branches: [master]
   pull_request:
-    # The branches below must be a subset of the branches above
     branches: [master]
   schedule:
-    - cron: '35 17 * * 0'
+    - cron: '17 2 * * 2'
+  workflow_run:
+    workflows:
+      - CD
+    types:
+      - completed
 
 jobs:
-  analyze:
-    name: Analyze
+  codeql:
+    name: CodeQL
     runs-on: ubuntu-20.04
     permissions:
       actions: read
@@ -33,39 +26,14 @@ jobs:
       fail-fast: false
       matrix:
         language: ['javascript']
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
-        # Learn more:
-        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3
-
-      # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
         uses: github/codeql-action/init@16964e90ba004cdf0cd845b866b5df21038b7723 # v2
         with:
           languages: ${{ matrix.language }}
-          # If you wish to specify custom queries, you can do so here or in a config file.
-          # By default, queries listed here will override any specified in a config file.
-          # Prefix the list here with "+" to use these queries and those in the config file.
-          # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-      # If this step fails, then you should remove it and run the build manually (see below)
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@16964e90ba004cdf0cd845b866b5df21038b7723 # v2
-
-      # ℹ️ Command-line programs to run using the OS shell.
-      # 📚 https://git.io/JvXDl
-
-      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-      #    and modify them (or add more) to build your code if your project
-      #    uses a compiled language
-
-      #- run: |
-      #   make bootstrap
-      #   make release
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@16964e90ba004cdf0cd845b866b5df21038b7723 # v2

.github/workflows/release.yml

@@ -13,39 +13,7 @@ on:
         required: false
 
 jobs:
-  snyk:
-    runs-on: ubuntu-20.04
-    env:
-      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      NODE_OPTIONS: --max-old-space-size=8192
-      GITHUB_CREDENTIALS: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3
-      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3
-        with:
-          cache: 'npm'
-          node-version-file: '.nvmrc'
-      - name: Install dependencies
-        run: |
-          npm ci
-          yarn install --no-immutable --mode=skip-build
-      - name: Snyk Test
-        run: |
-          npx snyk monitor      --dev --yarn-workspaces --exclude="project.json,npm-shim"
-          npx snyk test         --dev --yarn-workspaces --exclude="project.json,npm-shim"
-      - name: Snyk Code
-        continue-on-error: true
-        run: |
-          mkdir -p sarifs
-          npx snyk code test    --dev --all-projects --exclude="project.json,npm-shim" --sarif > ./sarifs/snyk-code.sarif
-      - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@16964e90ba004cdf0cd845b866b5df21038b7723 # v2
-        with:
-          sarif_file: ./sarifs
-      - name: Check Code Scanning alerts
-        run: node ./scripts/get-code-scanning-alerts.js
   release:
-    needs: snyk
     environment: 'Release'
     runs-on: ubuntu-20.04
     env: