Add datadog static analyzer

[juli1]

What does this PR do?

This PR adds supports for Datadog static analysis. It only checks rules that validates the GitHub actions are safe and secure.

Motivation

We want to ensure our GitHub actions are safe and secure.

Related

PR in datadog-agent

[datadog-datadog-prod-us1]

Software Composition Analysis

We found vulnerabilities in the following libraries (compared e492a6f against 5278b1c):

• 🔴 [email protected]
• 🔴 [email protected]
• 🔗 2 more vulnerabilities exist

[datadog-datadog-prod-us1]

Software Composition Analysis

We found vulnerabilities in the following libraries (compared 033e123 against 7539556):

• 🔴 [email protected]
• 🔴 [email protected]
• 🔗 2 more vulnerabilities exist

[github-actions]

Overall package size

Self size: 6.71 MB
Deduped: 61.96 MB
No deduping: 62.24 MB

Dependency sizes

name	version	self size	total size
@datadog/native-appsec	8.0.1	15.59 MB	15.6 MB
@datadog/native-iast-taint-tracking	2.1.0	14.91 MB	14.92 MB
@datadog/pprof	5.3.0	9.85 MB	10.22 MB
protobufjs	7.2.5	2.77 MB	6.56 MB
@datadog/native-iast-rewriter	2.3.1	2.15 MB	2.24 MB
@opentelemetry/core	1.14.0	872.87 kB	1.47 MB
@datadog/native-metrics	2.0.0	898.77 kB	1.3 MB
@opentelemetry/api	1.8.0	1.21 MB	1.21 MB
import-in-the-middle	1.7.4	70.19 kB	739.86 kB
msgpack-lite	0.1.26	201.16 kB	281.59 kB
opentracing	0.14.7	194.81 kB	194.81 kB
semver	7.5.4	93.4 kB	123.8 kB
pprof-format	2.1.0	111.69 kB	111.69 kB
@datadog/sketches-js	2.1.0	109.9 kB	109.9 kB
lodash.sortby	4.7.0	75.76 kB	75.76 kB
lru-cache	7.14.0	74.95 kB	74.95 kB
ignore	5.2.4	51.22 kB	51.22 kB
int64-buffer	0.1.10	49.18 kB	49.18 kB
shell-quote	1.8.1	44.96 kB	44.96 kB
istanbul-lib-coverage	3.2.0	29.34 kB	29.34 kB
tlhunter-sorted-set	0.1.0	24.94 kB	24.94 kB
limiter	1.1.5	23.17 kB	23.17 kB
dc-polyfill	0.1.4	23.1 kB	23.1 kB
retry	0.13.1	18.85 kB	18.85 kB
jest-docblock	29.7.0	8.99 kB	12.76 kB
crypto-randomuuid	1.0.0	11.18 kB	11.18 kB
path-to-regexp	0.1.7	6.78 kB	6.78 kB
koalas	1.0.2	6.47 kB	6.47 kB
module-details-from-path	1.0.3	4.47 kB	4.47 kB

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

[pr-commenter]

Benchmarks

Benchmark execution time: 2024-06-17 19:50:09

Comparing candidate commit 46ec6de in PR branch juli1/add-static-analyzer with baseline commit 7539556 in branch master.

Found 1 performance improvements and 0 performance regressions! Performance is the same for 258 metrics, 7 unstable metrics.

scenario:plugin-graphql-with-depth-off-18

• 🟩 max_rss_usage [-147.214MB; -82.766MB] or [-15.458%; -8.691%]

The merge-base changed after approval.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.93%. Comparing base (5278b1c) to head (033e123).
Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4400      +/-   ##
==========================================
+ Coverage   80.42%   81.93%   +1.50%     
==========================================
  Files           3      120     +117     
  Lines         373     4634    +4261     
  Branches       33       33              
==========================================
+ Hits          300     3797    +3497     
- Misses         73      837     +764     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.