Bump trufflesecurity/trufflehog from 3.95.8 to 3.95.9 #769

Workflow file for this run

	# This workflow uses actions that are not certified by GitHub.
	# They are provided by a third-party and are governed by
	# separate terms of service, privacy policy, and support
	# documentation.

	# This workflow checks out code, performs a Codacy security scan
	# and integrates the results with the
	# GitHub Advanced Security code scanning feature. For more information on
	# the Codacy security scan action usage and parameters, see
	# https://github.com/codacy/codacy-analysis-cli-action.
	# For more information on Codacy Analysis CLI in general, see
	# https://github.com/codacy/codacy-analysis-cli.

	name: Codacy Security Scan

	on:
	push:
	branches: [ "master" ]
	pull_request:
	# The branches below must be a subset of the branches above
	branches: [ "master" ]
	schedule:
	- cron: '21 11 * * 0'

	permissions:
	contents: read

	jobs:
	codacy-security-scan:
	outputs:
	has_runs: ${{ steps.normalize-sarif.outputs.has_runs }}
	sarif_files: ${{ steps.normalize-sarif.outputs.sarif_files }}
	permissions:
	contents: read # for actions/checkout to fetch code
	security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
	actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
	name: Codacy Security Scan
	runs-on: ubuntu-latest
	steps:
	# Checkout the repository to the GitHub Actions runner
	- name: Checkout code
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0

	# Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
	- name: Run Codacy Analysis CLI
	uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08
	with:
	# Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository
	# You can also omit the token and run the tools that support default configurations
	project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
	verbose: true
	output: results.sarif
	format: sarif
	# Adjust severity of non-security issues
	gh-code-scanning-compat: true
	# Force 0 exit code to allow SARIF file generation
	# This will handover control about PR rejection to the GitHub side
	max-allowed-issues: 2147483647

	- name: Normalize SARIF run categories
	id: normalize-sarif
	run: \|
	python - <<'PY'
	import json
	import os
	import re
	from pathlib import Path

	MAX_RUNS_PER_SARIF = 20
	sarif_path = Path("results.sarif")
	normalized_dir = Path("sarif-results")
	sarif = json.loads(sarif_path.read_text(encoding="utf-8"))
	seen_categories = set()
	runs = sarif.setdefault("runs", [])

	for index, run in enumerate(runs, start=1):
	tool = run.get("tool", {}).get("driver", {})
	tool_name = tool.get("name") or f"run-{index}"
	slug = re.sub(r"[^A-Za-z0-9_.-]+", "-", str(tool_name)).strip("-").lower()
	base_category = f"codacy/{slug or f'run-{index}'}"
	category = base_category
	suffix = 2

	while category in seen_categories:
	category = f"{base_category}-{suffix}"
	suffix += 1

	seen_categories.add(category)
	run.setdefault("automationDetails", {})["id"] = category

	for result in run.get("results", []):
	result.pop("partialFingerprints", None)

	normalized_dir.mkdir(exist_ok=True)
	for stale_file in normalized_dir.glob("*.sarif"):
	stale_file.unlink()

	chunks = [
	runs[index:index + MAX_RUNS_PER_SARIF]
	for index in range(0, len(runs), MAX_RUNS_PER_SARIF)
	]
	base_sarif = {key: value for key, value in sarif.items() if key != "runs"}

	for index, chunk in enumerate(chunks, start=1):
	chunked_sarif = {**base_sarif, "runs": chunk}
	normalized_path = normalized_dir / f"results.normalized.{index:02d}.sarif"
	normalized_path.write_text(
	json.dumps(chunked_sarif, separators=(",", ":")),
	encoding="utf-8",
	)

	if github_output := os.environ.get("GITHUB_OUTPUT"):
	sarif_files = [
	str(normalized_dir / f"results.normalized.{index:02d}.sarif")
	for index in range(1, len(chunks) + 1)
	]
	with open(github_output, "a", encoding="utf-8") as output:
	output.write(f"has_runs={'true' if runs else 'false'}\n")
	output.write(f"sarif_files={json.dumps(sarif_files, separators=(',', ':'))}\n")
	print(f"Normalized {len(runs)} SARIF run categories into {len(chunks)} file(s).")
	PY

	- name: Upload normalized SARIF artifact
	if: steps.normalize-sarif.outputs.has_runs == 'true'
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	with:
	name: codacy-sarif-results
	path: sarif-results/*.sarif
	if-no-files-found: error

	upload-codacy-sarif:
	name: Upload Codacy SARIF (${{ matrix.sarif_file }})
	needs: codacy-security-scan
	if: needs.codacy-security-scan.outputs.has_runs == 'true'
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	sarif_file: ${{ fromJson(needs.codacy-security-scan.outputs.sarif_files) }}
	permissions:
	contents: read
	security-events: write
	actions: read
	steps:
	- name: Download normalized SARIF artifact
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: codacy-sarif-results
	path: sarif-results

	- name: Upload SARIF results file
	uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
	with:
	sarif_file: ${{ matrix.sarif_file }}

Navigation Menu

Uh oh!

Bump trufflesecurity/trufflehog from 3.95.8 to 3.95.9 #769

Workflow file

Bump trufflesecurity/trufflehog from 3.95.8 to 3.95.9 #769

Uh oh!

Workflow file for this run