Add jenkins-security-scan workflow

.github/workflows/jss.yml

@@ -0,0 +1,75 @@
+name: Jenkins Security Scan
+
+on:
+  workflow_call:
+    inputs:
+      java-version:
+        description: Version of Java set up for the build. See actions/setup-java documentation for values.
+        type: string
+        required: true
+      java-cache:
+        description: What kind of Java dependency cache to set up. See actions/setup-java documentation for values.
+        type: string
+        required: false
+
+permissions:
+  security-events: write
+
+  # Private repo support
+  contents: read # For actions/checkout
+  actions: read # For github/codeql-action/upload-sarif
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest # Provides `jq`
+    steps:
+      - name: Check out plugin
+        uses: actions/checkout@v4
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: ${{ inputs.java-version }}
+          cache: ${{ inputs.java-cache }}
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: java
+          config: |
+            disable-default-queries: true
+            packs:
+            - jenkins-infra/[email protected]
+            - codeql/java-queries:AlertSuppression.ql
+            - codeql/java-queries:AlertSuppressionAnnotations.ql
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Run CodeQL
+        id: generate-sarif
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: Jenkins Security Scan
+          upload: failure-only
+
+      - name: Process SARIF
+        # Process the generated SARIF file:
+        # 1. Prevent conflicts with otherwise set up CodeQL scan by renaming the tool driver
+        # 2. Remove suppressed warnings because GitHub Code Scanning does not support inline suppressions
+        run: |
+          jq 'setpath(path(.runs[].tool.driver.name); "Jenkins Security Scan") | setpath(path(.runs[].tool.driver.organization); "Jenkins Project") | del(.runs[].results[] | select( .suppressions | length != 0 ))' ../results/java.sarif > jenkins-security-scan.sarif
+          mv -v ../results/java.sarif .
+
+      - name: Archive SARIF
+        uses: actions/upload-artifact@v4
+        with:
+          path: '*.sarif'
+          name: Jenkins Security Scan SARIF
+
+      - name: Upload Scan Result
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: jenkins-security-scan.sarif
+          category: Jenkins Security Scan