|
29 | 29 | with: |
30 | 30 | args: "-color -verbose" |
31 | 31 |
|
32 | | - # Runs the Octoscan GitHub Action workflow file linter. |
33 | | - # |
34 | | - # See https://github.com/synacktiv/octoscan |
35 | | - # |
36 | | - # This helps guard against injection attacks, credential exposure, vulnerable actions, repository jacking, |
37 | | - # dangerous checkouts, and artifact security issues. |
38 | | - octoscan: |
39 | | - name: Octoscan |
40 | | - runs-on: ubuntu-24.04 |
41 | | - permissions: |
42 | | - security-events: write |
43 | | - actions: read |
44 | | - contents: read |
45 | | - timeout-minutes: 10 |
46 | | - steps: |
47 | | - - name: Checkout code |
48 | | - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 |
49 | | - with: |
50 | | - persist-credentials: false |
51 | | - |
52 | | - - name: Run octoscan |
53 | | - id: octoscan |
54 | | - uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0 |
55 | | - with: |
56 | | - filter_triggers: '' |
57 | | - disable_rules: 'local-action,runner-label' |
58 | | - |
59 | | - - name: Upload SARIF file to GitHub |
60 | | - uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6 |
61 | | - with: |
62 | | - sarif_file: "${{steps.octoscan.outputs.sarif_output}}" |
63 | | - category: octoscan |
64 | | - wait-for-processing: false |
65 | | - |
66 | 32 | # Runs the Zizmor GitHub Action workflow file linter. |
67 | 33 | # |
68 | 34 | # See https://github.com/zizmorcore/zizmor |
|
96 | 62 | sarif_file: results.sarif |
97 | 63 | category: zizmor |
98 | 64 | wait-for-processing: false |
99 | | - |
100 | | - # Runs the Poutine GitHub Action workflow file linter. |
101 | | - # |
102 | | - # See https://github.com/boostsecurityio/poutine |
103 | | - # |
104 | | - # This helps guard against CI/CD pipeline risks, supply chain vulnerabilities, excessive permissions, |
105 | | - # and dangerous build platform configurations. |
106 | | - poutine: |
107 | | - name: Poutine |
108 | | - runs-on: ubuntu-24.04 |
109 | | - permissions: |
110 | | - security-events: write |
111 | | - contents: read |
112 | | - steps: |
113 | | - - name: Checkout repository |
114 | | - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 |
115 | | - with: |
116 | | - persist-credentials: false |
117 | | - |
118 | | - - name: Run Poutine |
119 | | - uses: boostsecurityio/poutine-action@84c0a0d32e8d57ae12651222be1eb15351429228 # v0.15.2 |
120 | | - |
121 | | - - name: Upload poutine SARIF file |
122 | | - uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6 |
123 | | - with: |
124 | | - sarif_file: results.sarif |
125 | | - category: poutine |
126 | | - wait-for-processing: false |
0 commit comments