static code scanning for CI/CD pipeline