security.yml

name: "Security Scanning"
on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
jobs:
  CodeQL:
    name: CodeQL
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
      with:
        fetch-depth: 2
    - name: Initialize CodeQL
      uses: github/codeql-action/init@3e7e3b32d0fb8283594bb0a76cc60a00918b0969 # tag=v2
      continue-on-error: true
      id: initcodeql
    - name: Autobuild
      if: steps.initcodeql.outcome == 'success'
      uses: github/codeql-action/autobuild@3e7e3b32d0fb8283594bb0a76cc60a00918b0969 # tag=v2
    - name: Perform CodeQL Analysis
      if: steps.initcodeql.outcome == 'success'
      uses: github/codeql-action/analyze@3e7e3b32d0fb8283594bb0a76cc60a00918b0969 # tag=v2

  ShiftLeft:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
    - name: Perform ShiftLeft Scan
      uses: ShiftLeftSecurity/scan-action@master
      env:
        WORKSPACE: ""
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SCAN_AUTO_BUILD: true
      with:
        output: reports
    - name: Upload report
      uses: github/codeql-action/upload-sarif@3e7e3b32d0fb8283594bb0a76cc60a00918b0969 # tag=v2
      with:
        sarif_file: reports