ci: add gosec to PRs and main (#750)

* ci: add gosec to PRs and main

* use informalsystems gosec

* add SARIF

* commit to test

* comment changes

Co-authored-by: Federico Kunze Küllmer <federico.kunze94@gmail.com>
Co-authored-by: Federico Kunze Küllmer <31522760+fedekunze@users.noreply.github.com>
This commit is contained in:
Prajjwol Gautam 2021-11-16 01:36:22 -08:00 committed by GitHub
parent d4621f3e82
commit d922441bec
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 40 additions and 4 deletions

34
.github/workflows/security.yml vendored Normal file
View File

@ -0,0 +1,34 @@
name: Run Gosec
on:
push:
branches:
- main
pull_request:
branches:
- '**'
jobs:
tests:
runs-on: ubuntu-latest
env:
GO111MODULE: on
steps:
- name: Checkout Source
uses: actions/checkout@v2.4.0
# - uses: technote-space/get-diff-action@v5
# with:
# SUFFIX_FILTER: |
# .go
# .mod
# .sum
- name: Run Gosec Security Scanner
uses: informalsystems/gosec@master
with:
args: ./...
# we let the report trigger content trigger a failure using the GitHub Security features.
# args: '-no-fail -fmt sarif -out results.sarif ./...'
# - name: Upload SARIF file
# uses: github/codeql-action/upload-sarif@v1
# with:
# # Path to SARIF file relative to the root of the repository
# sarif_file: results.sarif
# if: "env.GIT_DIFF != ''"

View File

@ -2,17 +2,19 @@ name: contracts
on: on:
push: push:
branches: master branches:
- main
pull_request: pull_request:
branches: '*' branches:
- '*'
jobs: jobs:
CI: CI:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v2 - uses: actions/checkout@v2.4.0
- name: Install node - name: Install node
uses: actions/setup-node@v1 uses: actions/setup-node@v2.4.1
with: with:
node-version: 12 node-version: 12
- name: Install - name: Install