security-code-scanner.yml

name: MetaMask Security Code Scanner

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

jobs:
  run-security-scan:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: MetaMask Security Code Scanner
        uses: MetaMask/action-security-code-scanner@v1
        with:
          repo: ${{ github.repository }}
          paths_ignored: |
            tests/
            docs/
            .storybook/
            '**/*.test.js'
            '**/*.test.ts'
            '**/*.test.jsx'
            '**/*.test.tsx'
            '**/*.stories.tsx'
            '**/*.stories.js'
            '**/*.snap'
          rules_excluded: example
          project_metrics_token: ${{secrets.SECURITY_SCAN_METRICS_TOKEN}}
          slack_webhook: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}