ci: enable gosec sarif upload (#776)

* ci: enable gosec sarif upload

* Update .github/workflows/security.yml

Co-authored-by: Federico Kunze Küllmer <31522760+fedekunze@users.noreply.github.com>
This commit is contained in:
Prajjwol Gautam 2021-11-24 03:42:47 -08:00 committed by GitHub
parent 2bf2b6758b
commit afe15fefe4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -1,34 +1,34 @@
name: Run Gosec
on:
pull_request:
push:
branches:
- main
pull_request:
branches:
- '**'
jobs:
tests:
Gosec:
runs-on: ubuntu-latest
env:
GO111MODULE: on
steps:
- name: Checkout Source
uses: actions/checkout@v2.4.0
# - uses: technote-space/get-diff-action@v5
# with:
# SUFFIX_FILTER: |
# .go
# .mod
# .sum
- name: Get Diff
uses: technote-space/get-diff-action@v5
with:
PATTERNS: |
**/*.go
go.mod
go.sum
- name: Run Gosec Security Scanner
uses: informalsystems/gosec@master
with:
args: ./...
# we let the report trigger content trigger a failure using the GitHub Security features.
# args: '-no-fail -fmt sarif -out results.sarif ./...'
# - name: Upload SARIF file
# uses: github/codeql-action/upload-sarif@v1
# with:
# # Path to SARIF file relative to the root of the repository
# sarif_file: results.sarif
# if: "env.GIT_DIFF != ''"
args: '-no-fail -fmt sarif -out results.sarif ./...'
if: "env.GIT_DIFF_FILTERED != ''"
- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@v1
with:
# Path to SARIF file relative to the root of the repository
sarif_file: results.sarif
if: "env.GIT_DIFF_FILTERED != ''"