Add workflow to allow dismissing specific CodeQL alerts #8767

	name: "CodeQL"

	on:
	push:
	branches: [master]
	pull_request:
	branches: [master]
	schedule:
	- cron: '20 0 * * 6'

	permissions:
	actions: read
	contents: read
	security-events: write

	jobs:
	analyze:
	name: Analyze
	runs-on: ${{ matrix.runs-on }}

	strategy:
	fail-fast: false
	matrix:
	include:
	- language: 'go'
	runs-on: ['self-hosted', '1ES.Pool=ubuntu2204']
	- language: 'javascript'
	runs-on: ['ubuntu-latest']
	- language: 'python'
	runs-on: ['ubuntu-latest']

	steps:
	- name: Install dependencies
	if: matrix.language == 'go'
	run: \|
	sudo apt-get update
	sudo apt-get install libbtrfs-dev libgpgme-dev libdevmapper-dev

	- name: Checkout repository
	uses: actions/checkout@v3

	- name: Set up Go
	if: matrix.language == 'go'
	uses: actions/setup-go@v4
	with:
	go-version-file: go.mod

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v2
	with:
	languages: ${{ matrix.language }}
	packs: "codeql/${{ matrix.language }}-queries:AlertSuppression.ql"

	- name: Autobuild
	uses: github/codeql-action/autobuild@v2

	- name: Perform CodeQL Analysis
	id: analyze
	uses: github/codeql-action/analyze@v2
	with:
	category: "/language:${{matrix.language}}"
	output: sarif-results

	- name: Dismiss alerts
	if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
	uses: advanced-security/dismiss-alerts@v1
	with:
	sarif-id: ${{ steps.analyze.outputs.sarif-id }}
	sarif-file: sarif-results/${{ matrix.language }}.sarif
	env:
	GITHUB_TOKEN: ${{ github.token }}

Provide feedback