From e2854cd20d50789aeffd1e2185ce9fbb17307d2b Mon Sep 17 00:00:00 2001
From: Juri Burakov <31932344+JuriBurakov@users.noreply.github.com>
Date: Sun, 26 Sep 2021 22:48:34 +0300
Subject: [PATCH] Create shiftleft-analysis.yml
---
.github/workflows/shiftleft-analysis.yml | 42 ++++++++++++++++++++++++
1 file changed, 42 insertions(+)
create mode 100644 .github/workflows/shiftleft-analysis.yml
diff --git a/.github/workflows/shiftleft-analysis.yml b/.github/workflows/shiftleft-analysis.yml
new file mode 100644
index 0000000..df025ec
--- /dev/null
+++ b/.github/workflows/shiftleft-analysis.yml
@@ -0,0 +1,42 @@
+# This workflow integrates Scan with GitHub's code scanning feature
+# Scan is a free open-source security tool for modern DevOps teams from ShiftLeft
+# Visit https://slscan.io/en/latest/integrations/code-scan for help
+name: SL Scan
+
+on:
+ push:
+ branches: [ main, setup-go ]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [ main ]
+ schedule:
+ - cron: '16 4 * * 0'
+
+jobs:
+ Scan-Build:
+ # Scan runs on ubuntu, mac and windows
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v2
+ # Instructions
+ # 1. Setup JDK, Node.js, Python etc depending on your project type
+ # 2. Compile or build the project before invoking scan
+ # Example: mvn compile, or npm install or pip install goes here
+ # 3. Invoke Scan with the github token. Leave the workspace empty to use relative url
+
+ - name: Perform Scan
+ uses: ShiftLeftSecurity/scan-action@master
+ env:
+ WORKSPACE: ""
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ SCAN_AUTO_BUILD: true
+ with:
+ output: reports
+ # Scan auto-detects the languages in your project. To override uncomment the below variable and set the type
+ # type: credscan,java
+ # type: python
+
+ - name: Upload report
+ uses: github/codeql-action/upload-sarif@v1
+ with:
+ sarif_file: reports