Setup security scanning tools

[iinuwa]

Some ideas:

• CodeQL: Built into GitHub, seems free?
• SonarCube: SAST with open source free plan
• Snyk Code: SAST with open source free plan

[Fraetor]

CodeQL is very easy to setup and is free for public repositories. I've found it more focuses on web application security however, so you might not find it producing that many useful results. Its easy enough to try and disable later if not useful.

You can enable it in the repository settings, under Settings > Advanced Security > Code scanning > Set up > Default > Enable CodeQL.

I don't have enough experience to comment on the other two.