Add code scanning action with HLint.

[chungyc]

With SARIF support now included, HLint can be used as a code scanning tool on GitHub.

This pull request adds a code scanning action using HLint. It creates a SARIF file with HLint and uploads it to GitHub, which can then put up code scanning alerts in its dashboards. This is separate from haskell/actions/hlint-run so that code scanning alerts can be dismissed without the underlying reason going away. I.e., if the alerts are intentionally dismissed, then the workflow shouldn't cause status checks to fail by returning non-zero exit codes.

Code scanning alerts are confirmed to appear for a test branch, although I'm not sure if anyone not collaborating directly with the fork can see them.

The relevant change in HLint has yet to be included in an official release, so this pull request will remain in draft until it is.

[andreasabel]

Thanks for your contribution @chungyc !

Atm, though, I am not accepting any more actions into this repo. I propose a split:

• 141

[chungyc]

Sounds reasonable to me. I will set up a separate repository with an eye to transferring it to https://github.com/haskell later.

Or would it be https://github.com/haskell-actions? Do you know yet? My own opinion (which doesn't count) is that core Haskell GitHub actions should be under haskell/, with the only reason not to being organizational.

[ulysses4ever]

I think we should be doing what everyone else does -- separate org. E.g.

• https://github.com/actions-rs
• https://github.com/julia-actions

Haven't looked further. I take these because: 1) Rust sets trends these days; 2) Julia is something I know very well from my personal work.

[chungyc]

I'm closing this pull request in favor of a separate repository in https://github.com/chungyc/hlint-scan.

[andreasabel]

Or would it be @haskell-actions?

Yes! It is open now for new actions!