Pre alerts from the static code analysis

[romuaa]

Alert about issues found with static code analysis and prevent merging until the issues are solved

• [ ] Set up static code analysis
• [ ] Configure static code analysis with sensible settings (at least sensible defaults)
• [ ] Configure alerts about issues
• [ ] Prevent merging (at least on severe issues)

Possible options to look at https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning

https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning

https://github.com/apps/codeclimate

https://github.com/marketplace/codacy

[github-actions[bot]]

This issue has been labeled stale because it has been open $INPUT_DAYS_BEFORE_STALE days with no activity.

[evolaine]

We already have implemented CodeQL in #14 but do we want Codacy or something else as well?

[romuaa]

I think CodeQL is enough for now. Let's see how it works (I haven't seen any notifications from it yet). We may want to consider / offer other options at later point as well.

[github-actions[bot]]

This issue has been labeled stale because it has been open 60 days with no activity.