security.yml

name: Security Scan

on:
  pull_request:
  push:
    branches:
      - main
      - canary
      - experimental
    paths-ignore:
      - "**/*.md"
      - ".all-contributorsrc"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

jobs:
  file-system-scan:
    name: Vulnerability scanning - File system
    uses: storm-software/storm-ops/.github/workflows/security-reusable.yml@main
    permissions:
      contents: read
      security-events: write
    with:
      scan-type: "fs"
      format: "sarif"
      exit-code: 0
      publish: true

  config-scan:
    name: Vulnerability scanning - Config
    uses: storm-software/storm-ops/.github/workflows/security-reusable.yml@main
    permissions:
      contents: read
      security-events: write
    with:
      scan-type: "config"
      format: "sarif"
      exit-code: 0
      publish: true