ci(gh-actions): add sast, code quality, and dependency scanning in gh…

… actions

start pointing at develop as our default branch to match reality

.github/workflows/code-quality.yml

@@ -0,0 +1,26 @@
+name: Run code quality scans
+
+on:
+  # Runs on pushes targeting the default branch
+  push:
+    branches: [ "develop" ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+  pull_request:
+
+code-quality:
+  name: Code Quality
+  runs-on: ubuntu-latest
+  steps:
+    - name: Check out code
+      uses: actions/checkout@v3
+
+    - name: Run Code Quality Report
+      run: code-quality-tool --output html
+
+    - name: Upload Code Quality Report
+      uses: actions/upload-artifact@v3
+      with:
+        name: code-quality-report
+        path: gl-code-quality-report.html

.github/workflows/dependency-scanning.yml

@@ -0,0 +1,20 @@
+name: Run dependency scanning
+
+on:
+  # Runs on pushes targeting the default branch
+  push:
+    branches: ["develop"]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+  pull_request:
+
+dependency-scanning:
+  name: Dependency Scanning
+  runs-on: ubuntu-latest
+  steps:
+    - name: Check out code
+      uses: actions/checkout@v3
+
+    - name: Run Dependency Scanning
+      run: gemnasium-scan --requirement-file requirements/base.txt

.github/workflows/docs.yml

@@ -3,7 +3,7 @@ name: Build sphinx docs
 on:
   # Runs on pushes targeting the default branch
   push:
-    branches: ["main"]
+    branches: ["develop"]
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:

.github/workflows/flake8.yml

@@ -3,7 +3,7 @@ name: Run flake8
 on:
   # Runs on pushes targeting the default branch
   push:
-    branches: ["main"]
+    branches: ["develop"]
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:

.github/workflows/sast.yml

@@ -0,0 +1,20 @@
+name: Run SAST
+
+on:
+  # Runs on pushes targeting the default branch
+  push:
+    branches: [ "develop" ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+  pull_request:
+
+sast:
+  name: Static Application Security Testing (SAST)
+  runs-on: ubuntu-latest
+  steps:
+    - name: Check out code
+      uses: actions/checkout@v3
+
+    - name: Run SAST
+      run: sast-tool