CodeQL CI job fails on main branch

[datumbox]

🐛 Describe the bug

The CodeQL fails on the latest main branch with the following error:

Traceback (most recent call last):
  File "setup.py", line 514, in <module>
    setup(
  File "/home/runner/.local/lib/python3.8/site-packages/setuptools/__init__.py", line 155, in setup
    return distutils.core.setup(**attrs)
  File "/home/runner/.local/lib/python3.8/site-packages/setuptools/_distutils/core.py", line 148, in setup
    return run_commands(dist)
  File "/home/runner/.local/lib/python3.8/site-packages/setuptools/_distutils/core.py", line 163, in run_commands
    dist.run_commands()
  File "/home/runner/.local/lib/python3.8/site-packages/setuptools/_distutils/dist.py", line 967, in run_commands
    self.run_command(cmd)
  File "/home/runner/.local/lib/python3.8/site-packages/setuptools/_distutils/dist.py", line 985, in run_command
    cmd_obj.ensure_finalized()
  File "/home/runner/.local/lib/python3.8/site-packages/setuptools/_distutils/cmd.py", line 107, in ensure_finalized
    self.finalize_options()
  File "/home/runner/.local/lib/python3.8/site-packages/setuptools/command/develop.py", line 52, in finalize_options
    easy_install.finalize_options(self)
  File "/home/runner/.local/lib/python3.8/site-packages/setuptools/command/easy_install.py", line 276, in finalize_options
    self._fix_install_dir_for_user_site()
  File "/home/runner/.local/lib/python3.8/site-packages/setuptools/command/easy_install.py", line 382, in _fix_install_dir_for_user_site
    self.create_home_path()
  File "/home/runner/.local/lib/python3.8/site-packages/setuptools/command/easy_install.py", line 1338, in create_home_path
    if path.startswith(home) and not os.path.isdir(path):
AttributeError: 'int' object has no attribute 'startswith'
Error: Process completed with exit code 1.

I've traced this back to a bug on the setuptools: pypa/setuptools#3063

There is already a fix about it at pypa/setuptools#3070

The issue exists on the latest version, possibly v60.5.0 works fine.

Versions

latest main

cc @seemethere

[NicolasHug]

We've had CodeQL for a while now. Has it ever proven useful? From my experience, it has only added noise. Same with bandit.

I wouldn't be against removing them

[datumbox]

I have yet to find a case where it gave me a useful signal since it's been added at #3625 about a year ago. I would be OK not having those 2 signals as I doubt that they add any value given the amount of scrutiny we put on PR reviews. One might argue that it's there in case someone sneaks in something and we don't notice, but I would say that's equally possible to happen anyway because a failing CodeQL doesn't block merge.

[datumbox]

The team at setuptools just pushed a new version (v60.7.0) which fixes the problem. Closing the issue.