Proposed RFC Feature: Static Analysis via GitHub Actions about sig-testing

[Kadino]

Some static analyzers appear more focused on security, and some . Need to clarify which aside from CodeQL are useful: https://codeql.github.com/docs/codeql-overview/

[Kadino]

This RFC will need to define how the emitted warnings are tracked and acted upon. Emitting them less than half the story.

[Kadino]

While it remains unclear what the requirements are of a static analysis tool, there is a request for a specific tool in o3de/o3de#10032

[lmbr-pip]

Would be good to cover how this work, if at all, with GitHub code scanning https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning

[Kadino]

If SIG-Testing investigates static analysis., be sure to sync with SIG-Build on requirements and recommendations. SIG-Build is looking into enabling static analysis.