Move SAST to its own workflow, revert checkout behavior on others

.github/workflows/deploy.yml

@@ -14,12 +14,6 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v2
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
     - run: git checkout HEAD^2
       if: ${{ github.event_name == 'pull_request' }}
 
@@ -49,7 +43,7 @@ jobs:
     needs: [test]
     steps:
     - name: Copy Repo Files
-      uses: actions/checkout@master
+      uses: actions/checkout@v2
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1

.github/workflows/release.yml

@@ -13,16 +13,6 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v2
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
-
-
     - name: Setup python
       uses: actions/setup-python@v1
       with:
@@ -49,7 +39,7 @@ jobs:
     needs: [test]
     steps:
     - name: Copy Repo Files
-      uses: actions/checkout@master
+      uses: actions/checkout@v2
     - name: Setup python
       uses: actions/setup-python@v1
       with:
@@ -69,7 +59,7 @@ jobs:
     needs: [test]
     steps:
     - name: Copy Repo Files
-      uses: actions/checkout@master
+      uses: actions/checkout@v2
     - name: get version
       run: echo "::set-env name=TAG::$(echo ${GITHUB_REF} | sed -e "s/refs\/tags\///g")"
     - name: Set up Docker Buildx

.github/workflows/sast.yml

@@ -0,0 +1,23 @@
+name: "Code scanning - action"
+
+on:
+  push:
+  schedule:
+    - cron: '59 23 * * *'
+
+jobs:
+  CodeQL-Build:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+      with:
+        fetch-depth: 2
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v1
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1

.github/workflows/tests.yml

@@ -16,16 +16,6 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v2
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
-
-
     - name: Setup python
       uses: actions/setup-python@v1
       with: