gha: add pr-validation GH action #4557

	name: codeql

	on:
	pull_request:
	branches:
	- main
	paths-ignore:
	- 'docs/**'
	push:
	branches:
	- main
	paths-ignore:
	- 'docs/**'
	schedule:
	- cron: "45 6 * * 3"

	permissions: read-all

	jobs:
	check_changes:
	name: Deduce required tests from code changes
	if: ${{ github.event_name == 'pull_request' }}
	runs-on: ubuntu-20.04
	outputs:
	go-changes: ${{ steps.go-changes.outputs.src }}
	steps:
	- name: Checkout code
	if: ${{ !github.event.pull_request }}
	uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
	with:
	persist-credentials: false
	- name: Check code changes
	uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
	id: go-changes
	with:
	base: ${{ github.event.pull_request.base.sha }}
	ref: ${{ github.event.pull_request.head.sha }}
	filters: \|
	src:
	- .github/workflows/lint-codeql.yaml
	- '*/.go'
	- 'go.mod'
	- 'go.sum'

	analyze:
	needs: check_changes
	if: ${{ needs.check_changes.outputs.go-changes == 'true' \|\| github.event_name != 'pull_request' }}
	runs-on: ubuntu-20.04
	permissions:
	security-events: write
	steps:
	- name: Checkout repo
	uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
	with:
	persist-credentials: false
	fetch-depth: 1
	- name: Initialize CodeQL
	uses: github/codeql-action/init@489225d82a57396c6f426a40e66d461b16b3461d # v2.20.4
	with:
	languages: go
	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@489225d82a57396c6f426a40e66d461b16b3461d # v2.20.4

Provide feedback