name: Run Gosec
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - '**'
jobs:
  tests:
    runs-on: ubuntu-latest
    env:
      GO111MODULE: on
    steps:
      - name: Checkout Source
        uses: actions/checkout@v2.4.0
      # - uses: technote-space/get-diff-action@v5
      #   with:
      #     SUFFIX_FILTER: |
      #       .go
      #       .mod
      #       .sum
      - name: Run Gosec Security Scanner
        uses: informalsystems/gosec@master
        with:
          args: ./...
          # we let the report trigger content trigger a failure using the GitHub Security features.
      #     args: '-no-fail -fmt sarif -out results.sarif ./...'
      # - name: Upload SARIF file
      #   uses: github/codeql-action/upload-sarif@v1
      #   with:
      #     # Path to SARIF file relative to the root of the repository
      #     sarif_file: results.sarif
        # if: "env.GIT_DIFF != ''"