Add CI_STATUSES_TOKEN

Fold Code Scanning workflow into CI Pipeline

Fixes #1638

Update to v3 CodeQL action

.github/workflows/ci-pipeline.yml

@@ -81,6 +81,36 @@ jobs:
     - name: GitHub Requires at Least One Step for a Job
       run: exit 0
 
+  code-scanning:
+    name: Code Scanning
+    needs: start-ci-run-gate
+    runs-on: ubuntu-latest
+    steps:
+    - name: Setup dotnet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: '${{ env.TGS_DOTNET_VERSION }}.0.x'
+        dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }}
+
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: csharp
+        token: ${{ secrets.CI_STATUSES_TOKEN }}
+
+    - name: Build
+      run: dotnet build -c ReleaseNoWindows -p:TGS_HOST_NO_WEBPANEL=true
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:csharp"
+        token: ${{ secrets.CI_STATUSES_TOKEN }}
+
+
   dmapi-build:
     name: Build DMAPI
     needs: start-ci-run-gate
@@ -1341,12 +1371,18 @@ jobs:
 
   ci-completion-gate: # This job exists so there isn't a moving target for branch protections
     name: CI Completion Gate
-    needs: [ pages-build, docker-build, build-deb, build-msi, validate-openapi-spec, upload-code-coverage, check-winget-pr-template ]
+    needs: [ pages-build, docker-build, build-deb, build-msi, validate-openapi-spec, upload-code-coverage, check-winget-pr-template, code-scanning ]
     runs-on: ubuntu-latest
     if: (!(cancelled() || failure()) && needs.pages-build.result == 'success' && needs.docker-build.result == 'success' && needs.build-deb.result == 'success' && needs.build-msi.result == 'success' && needs.validate-openapi-spec.result == 'success' && needs.upload-code-coverage.result == 'success' && needs.check-winget-pr-template.result == 'success')
     steps:
-    - name: GitHub Requires at Least One Step for a Job
-      run: exit 0
+    - name: Create Completion Check
+      uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23
+      with:
+        token: ${{ secrets.CI_STATUSES_TOKEN }}
+        name: CI Completion
+        conclusion: success
+        output: |
+          {"summary":"The CI Pipeline completed successfully"}
 
   deployment-gate:
     name: Deployment Start Gate

.github/workflows/code-scanning.yml

@@ -1,51 +0,0 @@
-name: 'Code Scanning'
-
-on:
-  push:
-    branches:
-    - dev
-    - master
-  pull_request:
-    branches:
-    - dev
-    - master
-
-env:
-  TGS_DOTNET_VERSION: 8
-  TGS_DOTNET_QUALITY: ga
-
-concurrency:
-  group: "code-scanning-${{ github.head_ref || github.run_id }}-${{ github.event_name }}"
-  cancel-in-progress: true
-
-jobs:
-  analyze:
-    name: Code Scanning
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    if: ${{ vars.TGS_ENABLE_CODE_QL }} == 'true'
-    steps:
-    - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
-      with:
-        dotnet-version: '${{ env.TGS_DOTNET_VERSION }}.0.x'
-        dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }}
-
-    - name: Checkout
-      uses: actions/checkout@v4
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: csharp
-
-    - name: Build
-      run: dotnet build -c ReleaseNoWindows -p:TGS_HOST_NO_WEBPANEL=true
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
-      with:
-        category: "/language:csharp"