Should we include code-scanning in our repo's?

[stijnmoreels]

Could we consider adding GitHub code-scanning to our Arcus repositories?
Seems like a good thing that the umbrella code is also verified in every possible way.

[pim-simons]

Seems like a good idea 👍🏻 any downsides to this?
Any idea how much this will cost (https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning#about-billing-for-code-scanning)?

[stijnmoreels]

Downside I could think of, is that we may get warnings on things we can't change (yet) because it would break something or is obsolete.
About costs: I honestly don't know. I think I saw that we get some free space to run them, but maybe with our GitHub Enterprise accounts there's more possible.

[pim-simons]

Downside I could think of, is that we may get warnings on things we can't change (yet) because it would break something or is obsolete.

That's a good one, but couldn't hurt to give it a try, not sure how much time it takes to set it up?

[fgheysels]

I think it is a good idea to do this, and as @pim-simons says: let's give it a try and see what the outcome is.

Warnings can be fixed, and those warnings can be a 'heads up' to make sure that we do not rely on deprecated packages, be aware of vulnerabilities, etc.... In other words: they'll inform us that we need to improve things.

[stijnmoreels]

Done in #197

[stijnmoreels]

Results so far have been great, I think. It's now part of every library, now. Except Arcus Scripting... Will need to check if we have something for that too.