Skip to content

Security

Security #449

Workflow file for this run

name: Security
on:
push:
branches:
- main
paths-ignore:
- '**.md'
# every Sunday at midnight
schedule:
- cron: '0 0 * * 0'
permissions:
actions: read
contents: read
security-events: write
jobs:
codeql:
name: CodeQL
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: python
- name: Run CodeQL
uses: github/codeql-action/analyze@v3
ossar:
name: OSSAR
runs-on: windows-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Run OSSAR
id: ossar
uses: github/ossar-action@v1
- name: Upload OSSAR results
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ steps.ossar.outputs.sarifFile }}
semgrep:
name: Semgrep
runs-on: ubuntu-latest
container:
image: semgrep/semgrep
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Run Semgrep
run: semgrep scan --config auto --sarif > semgrep.sarif
- name: Upload Semgrep results
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: semgrep.sarif