Fix CodeQL scans for golang

[geigerj0]

Problem

The CodeQL scans stopped working after the go version was bumped from 1.20 to 1.21: 9a9d98c#diff-751af1a340658c7b8176fe32d7db9fadbe15d1d075daba1919a91df04155bc70R9. Note that for this commit, the CodeQL scans were still working because the Docker image being used during the scan was still on 1.20. Following commits started to have failing CodeQL scans for Go: https://github.com/cloudfoundry/app-autoscaler-release/commits/main/?since=2024-01-08&until=2024-01-08.

The root cause why the scans stopped working with go 1.21 in combination with our own autoscaler-tools Docker image is the following:

• Golang binaries are statically linked with 1.21 for linux
• CodeQL does a little trick to still be able to create trace files: Install wrapper script for Go on Linux to support tracing for Go 1.21 and above github/codeql-action#1909
• The CodeQL workaround requires file command to be availabe which is not the case for our Docker image
  • https://github.com/github/codeql-action/blob/592977e6ae857384aa79bb31e7a1d62d63449ec5/src/init-action.ts#L343
  • https://github.com/github/codeql-action/blob/main/src/actions-util.ts#L441

Solution

Install file for our autoscaler-release-tools Docker image so that the CodeQL workaround for go 1.21 actually works.

Tests if solution works

• The following commit uses a fork of our autoscaler-tools Docker image that comes with go 1.21 and file: a8ed629
• CodeQL scans passed using the enhanced Docker image https://github.com/cloudfoundry/app-autoscaler-release/actions/runs/7981410434/job/21793043637

Why are scans not working for latest commit of this PR?

Because the CI pipeline is still using a Docker image that doesn't come with file. After this PR has been merged, a new Docker image will be build. This causes subsequent CodeQL scans to work again.

[silvestre]

Wow. nice sleuthing!

[sonarcloud]

Quality Gate passed

Issues
0 New issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[geigerj0]

The scans are back after merging this to main 🚀: https://github.com/cloudfoundry/app-autoscaler-release/actions/runs/7988268158/job/21812725945