Add CI_STATUSES_TOKEN

Fold Code Scanning workflow into CI Pipeline

Fixes #1638

Update to v3 CodeQL action

.github/CONTRIBUTING.md

@@ -60,11 +60,11 @@ You must also have the following environment variables set. To run them more acc
 
 For the full CI gambit, the following repository configuration must be set:
 
-- Setting `Workflow Permissions` to `Read and write permissions`: Enables CodeQL uploads and GitHub Actions comments.
+- Setting `Workflow Permissions` to `Read and write permissions`: Enables GitHub Actions comments.
 ![image](https://github.com/tgstation/tgstation-server/assets/8171642/ab17fa74-364f-4e66-b7c4-b9bb24c6a599)
 - Label `CI Cleared`: To allow PRs from forks to run CI with secrets after approval.
-- Variable `TGS_ENABLE_CODE_QL` to `true`: Enables CodeQL scanning in actions.
 - Integration [CodeCov](https://github.com/apps/codecov): Enables CodeCov status checks.
+- Secret `CI_STATUSES_TOKEN`: A GitHub token with read access to the repository's contents/actions and write access to the repository's checks/security events. Used to create CI completion statuses.
 - Secret `CODECOV_TOKEN`: A CodeCov repo token to work around https://github.com/codecov/codecov-action/issues/837.
 - Secret `LIVE_TESTS_TOKEN`: A GitHub token with read access to the repository and write access to https://github.com/Cyberboss/common_core (TODO: Make the target repository here configurable). Despite it's name, it may be used across the entire test suite.
 - Secret `TGS_TEST_DISCORD_TOKEN`: See above note about test environment variables.
@@ -74,7 +74,7 @@ For the full CI gambit, the following repository configuration must be set:
 
 If you don't plan on deploying TGS, the following secrets can be omitted:
 
-- Secret `DEV_PUSH_TOKEN`: A GitHub token with write access to the repository. Enables doxygen pushes to `gh-pages` branch, and releases creation.
+- Secret `DEV_PUSH_TOKEN`: A GitHub token with read/write access to the repository. Enables doxygen pushes to `gh-pages` branch, and releases creation.
 - Secret `DOCKER_USERNAME`: Login username for Docker image push.
 - Secret `DOCKER_PASSWORD`: Login password for Docker image push.
 - Secret `NUGET_API_KEY`: Nuget.org API Key for client libraries push.

.github/workflows/ci-pipeline.yml

@@ -81,6 +81,36 @@ jobs:
     - name: GitHub Requires at Least One Step for a Job
       run: exit 0
 
+  code-scanning:
+    name: Code Scanning
+    needs: start-ci-run-gate
+    runs-on: ubuntu-latest
+    steps:
+    - name: Setup dotnet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: '${{ env.TGS_DOTNET_VERSION }}.0.x'
+        dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }}
+
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: csharp
+        token: ${{ secrets.CI_STATUSES_TOKEN }}
+
+    - name: Build
+      run: dotnet build -c ReleaseNoWindows -p:TGS_HOST_NO_WEBPANEL=true
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:csharp"
+        token: ${{ secrets.CI_STATUSES_TOKEN }}
+
+
   dmapi-build:
     name: Build DMAPI
     needs: start-ci-run-gate
@@ -1341,12 +1371,18 @@ jobs:
 
   ci-completion-gate: # This job exists so there isn't a moving target for branch protections
     name: CI Completion Gate
-    needs: [ pages-build, docker-build, build-deb, build-msi, validate-openapi-spec, upload-code-coverage, check-winget-pr-template ]
+    needs: [ pages-build, docker-build, build-deb, build-msi, validate-openapi-spec, upload-code-coverage, check-winget-pr-template, code-scanning ]
     runs-on: ubuntu-latest
     if: (!(cancelled() || failure()) && needs.pages-build.result == 'success' && needs.docker-build.result == 'success' && needs.build-deb.result == 'success' && needs.build-msi.result == 'success' && needs.validate-openapi-spec.result == 'success' && needs.upload-code-coverage.result == 'success' && needs.check-winget-pr-template.result == 'success')
     steps:
-    - name: GitHub Requires at Least One Step for a Job
-      run: exit 0
+    - name: Create Completion Check
+      uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23
+      with:
+        token: ${{ secrets.CI_STATUSES_TOKEN }}
+        name: CI Completion
+        conclusion: success
+        output: |
+          {"summary":"The CI Pipeline completed successfully"}
 
   deployment-gate:
     name: Deployment Start Gate

.github/workflows/code-scanning.yml

@@ -1,51 +0,0 @@
-name: 'Code Scanning'
-
-on:
-  push:
-    branches:
-    - dev
-    - master
-  pull_request:
-    branches:
-    - dev
-    - master
-
-env:
-  TGS_DOTNET_VERSION: 8
-  TGS_DOTNET_QUALITY: ga
-
-concurrency:
-  group: "code-scanning-${{ github.head_ref || github.run_id }}-${{ github.event_name }}"
-  cancel-in-progress: true
-
-jobs:
-  analyze:
-    name: Code Scanning
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    if: ${{ vars.TGS_ENABLE_CODE_QL }} == 'true'
-    steps:
-    - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
-      with:
-        dotnet-version: '${{ env.TGS_DOTNET_VERSION }}.0.x'
-        dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }}
-
-    - name: Checkout
-      uses: actions/checkout@v4
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: csharp
-
-    - name: Build
-      run: dotnet build -c ReleaseNoWindows -p:TGS_HOST_NO_WEBPANEL=true
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
-      with:
-        category: "/language:csharp"