Cleanup of CodeQL workflow

[paulcacheux]

What does this PR do?

The CodeQL jobs are generating a lot of noise especially when you list all commits from the main branch (https://github.com/DataDog/datadog-agent/commits/main).
Here for example we only see failing commits because of the CodeQL results that are failing to understand that main is the default branch and tries to compare with master which is not evaluated.

Looking at the logs, I saw:

fatal: not a git repository (or any of the parent directories): .git
Failed to call git to get current commit. Continuing with data from environment: Error: The process '/bin/git' failed with exit code 128
Error: The process '/bin/git' failed with exit code 128
    at ExecState._setResult (/home/runner/work/_actions/github/codeql-action/v1/node_modules/@actions/exec/lib/toolrunner.js:592:25)
    at ExecState.CheckComplete (/home/runner/work/_actions/github/codeql-action/v1/node_modules/@actions/exec/lib/toolrunner.js:575:18)
    at ChildProcess.<anonymous> (/home/runner/work/_actions/github/codeql-action/v1/node_modules/@actions/exec/lib/toolrunner.js:469:27)
    at ChildProcess.emit (events.js:210:5)
    at maybeClose (internal/child_process.js:1021:16)
    at Socket.<anonymous> (internal/child_process.js:430:11)
    at Socket.emit (events.js:210:5)
    at Pipe.<anonymous> (net.js:659:12)

I believe codeql is confused by the complexity of the path used in the workflow and fails to fetch the current/base commit refs.

This PR tries to reduce this complexity by removing references to useless GOPATH or go/src/github.com/.... This is possible since the agent is go 1.11 module aware and thus doesn't require this setup.

It is of course impossible to guarantee that this will do what it should, in the pure tradition of github actions.

Motivation

Additional Notes

Possible Drawbacks / Trade-offs

Describe how to test/QA your changes

Reviewer's Checklist

• If known, an appropriate milestone has been selected; otherwise the Triage milestone is set.
• The appropriate team/.. label has been applied, if known.
• A release note has been added or the changelog/no-changelog label has been applied.
• Changed code has automated tests for its functionality.
• Adequate QA/testing plan information is provided if the qa/skip-qa label is not applied.
• If applicable, docs team has been notified or an issue has been opened on the documentation repo.
• If applicable, the need-change/operator and need-change/helm labels have been applied.
• If applicable, the config template has been updated.

[ganeshkumarsv]

LGTM! I'd like to have one more review from @stephengroat-dd

[stephengroat-dd]

lgtm, slight ask to add the go modules cache if were making a change (sorry for the multiple user names, was performing some testing)

[paulcacheux]

Hello ! I think this is a good idea and should absolutely be done (even for Python deps). But currently the go dependencies are downloaded between the codeql init and the codeql analyse steps which means that there is a possibility that they are analysed by CodeQL. I believe this warrants a separate PR to ensure that we are still getting the same amount of security findings.

[paulcacheux]

Sadly this doesn't seem to fix the issue with the default branch. Happy to revert if you preferred the old way