|
22 | 22 | uses: docker://rhysd/actionlint:1.7.7 |
23 | 23 | with: |
24 | 24 | args: "-color -verbose" |
25 | | - |
26 | | - octoscan: |
27 | | - name: Octoscan |
28 | | - runs-on: ubuntu-latest |
29 | | - permissions: |
30 | | - security-events: write |
31 | | - actions: read |
32 | | - contents: read |
33 | | - timeout-minutes: 10 |
34 | | - steps: |
35 | | - - name: Checkout code |
36 | | - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
37 | | - with: |
38 | | - persist-credentials: false |
39 | | - |
40 | | - - name: Run octoscan |
41 | | - id: octoscan |
42 | | - uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0 |
43 | | - with: |
44 | | - filter_triggers: '' |
45 | | - |
46 | | - - name: Upload SARIF file |
47 | | - uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1 |
48 | | - with: |
49 | | - sarif_file: ${{steps.octoscan.outputs.sarif_output}} |
50 | | - category: octoscan |
51 | | - |
52 | | - zizmor: |
53 | | - name: Zizmor |
54 | | - runs-on: ubuntu-latest |
55 | | - permissions: |
56 | | - security-events: write |
57 | | - actions: read |
58 | | - contents: read |
59 | | - steps: |
60 | | - - name: Checkout repository |
61 | | - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
62 | | - with: |
63 | | - persist-credentials: false |
64 | | - |
65 | | - - name: Install the latest version of uv |
66 | | - uses: astral-sh/setup-uv@b5f58b2abc5763ade55e4e9d0fe52cd1ff7979ca # v5.2.1 |
67 | | - |
68 | | - # https://github.com/woodruffw/zizmor |
69 | | - - name: Run zizmor |
70 | | - run: uvx [email protected] --format sarif . > results.sarif |
71 | | - env: |
72 | | - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
73 | | - |
74 | | - - name: Upload SARIF file |
75 | | - uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1 |
76 | | - with: |
77 | | - sarif_file: results.sarif |
78 | | - category: zizmor |
79 | | - |
80 | | - poutine: |
81 | | - name: Poutine |
82 | | - runs-on: ubuntu-latest |
83 | | - permissions: |
84 | | - security-events: write |
85 | | - contents: read |
86 | | - steps: |
87 | | - - name: Checkout repository |
88 | | - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
89 | | - with: |
90 | | - persist-credentials: false |
91 | | - |
92 | | - - name: Run Poutine |
93 | | - uses: boostsecurityio/poutine-action@84c0a0d32e8d57ae12651222be1eb15351429228 # v0.15.2 |
94 | | - |
95 | | - - name: Upload SARIF file |
96 | | - uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1 |
97 | | - with: |
98 | | - sarif_file: results.sarif |
99 | | - category: poutine |
0 commit comments