Switching to CodeQL & Dependabot

[scherersebastian]

We're moving from Veracode to CodeQL and Dependabot. This switch brings better GitHub integration, at no extra cost, making our security setup more efficient.

What's Changing:

• Better GitHub Fit: Direct integration with GitHub for security scans and dependency updates.
• Free: Both tools are free, cutting costs.
• Centralized Alerts: Findings now appear in the GitHub Security tab for easier management.

Quick Details:

• CodeQL identifies vulnerabilities directly in the code.
• Dependabot keeps our dependencies fresh and secure.

This update streamlines our security and dependency management, directly within GitHub.

---

You have dependabot and codeql already integrated :)

[scherersebastian]

I also removed spotbugs workflow and config.
CodeQL covers static analysis for spotbugs / java.
Of course you can run both - it's your choice.

[scherersebastian]

I removed your trivy workflow that scans the IaC analyze-config.
KICS does a better job at IaC scanning.
You do not need to run both.

[sonarcloud]

Quality Gate passed

Issues
0 New issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[jzbmw]

@scherersebastian bevor the QQ Criteria are not updated, we will not approve this. Please make sure, that the QG Criteria for 24.03 and 24.05 are updated.

[scherersebastian]

Interesting, I will take care of this.
Thanks for your feedback @jzbmw

[scherersebastian]

Hello @jzbmw , I've reviewed our QGs. With Dependabot and CodeQL, we can successfully meet all QGs, serving as a replacement for Veracode (SCA, SAST). If this isn't clearly derived from the QGs, I'm happy to provide further feedback.