ci: enable gosec sarif upload (#776)

* ci: enable gosec sarif upload

* Update .github/workflows/security.yml

Co-authored-by: Federico Kunze Küllmer <31522760+fedekunze@users.noreply.github.com>

.github/workflows/security.yml

@@ -1,34 +1,34 @@
 name: Run Gosec
 on:
+  pull_request:
   push:
     branches:
       - main
-  pull_request:
-    branches:
-      - '**'
+
 jobs:
-  tests:
+  Gosec:
     runs-on: ubuntu-latest
     env:
       GO111MODULE: on
     steps:
       - name: Checkout Source
         uses: actions/checkout@v2.4.0
-      # - uses: technote-space/get-diff-action@v5
-      #   with:
-      #     SUFFIX_FILTER: |
-      #       .go
-      #       .mod
-      #       .sum
+      - name: Get Diff
+        uses: technote-space/get-diff-action@v5
+        with:
+          PATTERNS: |
+            **/*.go
+            go.mod
+            go.sum
       - name: Run Gosec Security Scanner
         uses: informalsystems/gosec@master
         with:
-          args: ./...
           # we let the report trigger content trigger a failure using the GitHub Security features.
-      #     args: '-no-fail -fmt sarif -out results.sarif ./...'
-      # - name: Upload SARIF file
-      #   uses: github/codeql-action/upload-sarif@v1
-      #   with:
-      #     # Path to SARIF file relative to the root of the repository
-      #     sarif_file: results.sarif
-        # if: "env.GIT_DIFF != ''"
+          args: '-no-fail -fmt sarif -out results.sarif ./...'
+        if: "env.GIT_DIFF_FILTERED != ''"
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          # Path to SARIF file relative to the root of the repository
+          sarif_file: results.sarif
+        if: "env.GIT_DIFF_FILTERED != ''"