Update secret-scanning.yml

changed runner from windows-latest to ubuntu-latest, removed manual powershell uploader, added the upload-sarif from msdo-reusable.yml, and added in GH_Token

Author: theangrytech-git

.github/workflows/secret-scanning.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   secret-scan:
     name: MSDO Secret Scan
-    runs-on: windows-latest
+    runs-on: ubuntu-latest
 
     permissions:
       contents: read
@@ -17,45 +17,23 @@ jobs:
 
     steps:
       - name: Checkout code
-        shell: pwsh
         run: |
           git clone https://github.com/${{ github.repository }} .
           git checkout ${{ github.ref_name }}
 
       - name: Set tool to only run secret scan
-        shell: pwsh
-        run: |
-          echo "TOOLS=credscan" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8
+        run: echo "TOOLS=credscan" >> $GITHUB_ENV
 
       - name: Run Microsoft Security DevOps - Secret Scan
         uses: theangrytech-git/security-devops-action@main
         id: msdo
         with:
           tools: ${{ env.TOOLS }}
 
-      - name: Upload SARIF to GitHub (if public)
+      - name: Upload alerts to GitHub code scanning
         if: github.repository_visibility == 'public'
-        shell: pwsh
-        run: |
-          Write-Host "Uploading SARIF to GitHub Code Scanning"
-          $sarifFile = "${{ steps.msdo.outputs.sarifFile }}"
-          if (-not (Test-Path $sarifFile)) {
-            Write-Host "SARIF file not found. Skipping upload."
-            exit 0
-          }
-          # Use GitHub's SARIF upload API manually (for public repos)
-          $headers = @{ Authorization = "Bearer ${{ secrets.GITHUB_TOKEN }}" }
-          $body = @{
-            commit_sha = "${{ github.sha }}"
-            ref = "${{ github.ref }}"
-            sarif = [System.IO.File]::ReadAllText($sarifFile) -replace "`r`n", "\n"
-            checkout_uri = "https://github.com/${{ github.repository }}"
-            tool_name = "msdo-credscan"
-          } | ConvertTo-Json -Depth 10
-
-          Invoke-RestMethod `
-            -Uri "https://api.github.com/repos/${{ github.repository }}/code-scanning/sarifs" `
-            -Method POST `
-            -Headers $headers `
-            -Body $body `
-            -ContentType "application/json"
+        uses: ./.github/actions/upload-sarif
+        with:
+          sarif_file: ${{ steps.msdo.outputs.sarifFile }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}