Proposal: Enable security vulnerability scans on OTel repos about oteps

[arminru]

@alolita Should we close this issue in favor of open-telemetry/opentelemetry-specification#1333 and keep track of the progress there?

[trask]

Hey all, we got our first CodeQL security alert! (https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/code-scanning/1)

But we didn't notice it for several days, because it didn't generate any notifications (@anuraaga just happened to go looking for it today).

Does anyone know what we need to make it generate notifications?

Thanks!

[alolita]

Please assign @xukaren and @KKelvinLo to this issue too - since they're adding the security workflows for the rest of the OpenTelemetry code repos. See open-telemetry/opentelemetry-specification#1333 for additional detail.

[arminru]

Thank you for taking care of this, @alolita, @xukaren and @KKelvinLo!