mobsf.yml

name: "Vulnerability Scan with MobSF"

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    - cron: '30 6 * * 1'
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

permissions:
  contents: read

jobs:
  mobile-security:
    name: MobSF Scan
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status

    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4.2.2

      # Sets up the python as a prerequisites for MobSF
      - name: Setup python
        uses: actions/setup-python@v5.3.0
        with:
          python-version: 3.8

      # Sets up the reviewdog cli
      - name: Setup reviewdog
        uses: reviewdog/action-setup@v1.3.0

      - name: Show reviewdog version
        run: reviewdog -version

      # Performs analysis using MobSF and outputs a Sarif Report
      - name: Run mobsfscan
        uses: MobSF/mobsfscan@d94f4a5a86bb7f3b79bc64b6fd306adb17379cbe
        with:
          args: . --sarif --output mobsf.sarif.json || true

      # Uploads Sarif Report to GitHub
      - name: Upload mobsfscan report
        uses: github/codeql-action/upload-sarif@v3.27.1
        if: success() || failure()
        with:
          sarif_file: mobsf.sarif.json

      # Process Sarif Report file from MobSF with reviewdog cli
      - name: Run reviewdog
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        if: success() || failure()
        run: reviewdog -f=sarif -diff="git diff FETCH_HEAD" -name="mobsf" -reporter=github-pr-check < mobsf.sarif.json