security.yml

name: 'CI -> Security'
on:
  branch_protection_rule:
  schedule:
    - cron: '33 3 * * 1'

  push:
    branches:
      - dev
    paths-ignore:
      - '*.md'
      - '.*ignore'

  pull_request:
    branches:
      - dev
    paths-ignore:
      - '*.md'
      - '.*ignore'

permissions: read-all

jobs:
  codeql:
    name: 'CodeQL'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        language:
          - javascript-typescript

    permissions:
      security-events: write

    steps:
      - name: 'Harden Runner'
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit

      - name: 'Checkout'
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          persist-credentials: false

      - name: 'Setup CodeQL'
        uses: github/codeql-action/init@b611370bb5703a7efb587f9d136a52ea24c5c38c # v3.25.11
        with:
          languages: ${{ matrix.language }}

      - name: 'Run analysis'
        uses: github/codeql-action/analyze@b611370bb5703a7efb587f9d136a52ea24c5c38c # v3.25.11
        with:
          category: '/language:${{ matrix.language }}'

  scoreboard:
    name: 'Scorecard'
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      id-token: write

    steps:
      - name: 'Harden Runner'
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit

      - name: 'Checkout'
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          persist-credentials: false

      - name: 'Run analysis'
        uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
        with:
          results_file: scoreboard.sarif
          results_format: sarif
          publish_results: true

      - name: 'Upload to code-scanning'
        uses: github/codeql-action/upload-sarif@b611370bb5703a7efb587f9d136a52ea24c5c38c # v3.25.11
        with:
          sarif_file: scoreboard.sarif