Merge PR #168 #355
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OSSAR | |
| # Define the events that trigger this workflow | |
| on: | |
| push: | |
| branches: ["main"] # Trigger on push to the "main" branch | |
| pull_request: | |
| branches: ["main"] # Trigger on pull request to the "main" branch | |
| schedule: | |
| - cron: "41 10 * * 1" # Trigger on a schedule every Monday at 10:41 AM UTC | |
| # Define permissions required for the workflow | |
| permissions: | |
| contents: read # Required to fetch code using actions/checkout | |
| jobs: | |
| OSSAR-Scan: | |
| # Define permissions for the OSSAR-Scan job | |
| permissions: | |
| contents: read # Required for actions/checkout to fetch code | |
| security-events: write # Required for github/codeql-action/upload-sarif to upload SARIF results | |
| actions: read # Only required for private repositories to get the Action run status | |
| # Specify the runner to use (windows-latest) | |
| runs-on: windows-latest | |
| steps: | |
| # Step to harden the runner for security purposes | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0 | |
| with: | |
| egress-policy: audit | |
| # Step to checkout the repository | |
| - name: Checkout repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| # Ensure a compatible version of dotnet is installed. | |
| # The [Microsoft Security Code Analysis CLI](https://aka.ms/mscadocs) is built with dotnet v3.1.201. | |
| # A version greater than or equal to v3.1.201 of dotnet must be installed on the agent in order to run this action. | |
| # GitHub hosted runners already have a compatible version of dotnet installed and this step may be skipped. | |
| # For self-hosted runners, ensure dotnet version 3.1.201 or later is installed by including this action: | |
| # - name: Install .NET | |
| # uses: actions/setup-dotnet@v2 | |
| # with: | |
| # dotnet-version: '3.1.x' | |
| # Run open source static analysis tools | |
| - name: Run OSSAR | |
| uses: github/ossar-action@786a16a90ba92b4ae6228fe7382fb16ef5c51000 # v1 | |
| id: ossar | |
| # Upload results to the Security tab | |
| - name: Upload OSSAR results | |
| uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10 | |
| with: | |
| sarif_file: ${{ steps.ossar.outputs.sarifFile }} |