DVWA/.github/workflows/shiftleft-analysis.yml at master · digininja/DVWA · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
# This workflow integrates Scan with GitHub's code scanning feature
# Scan is a free open-source security tool for modern DevOps teams from ShiftLeft
# Visit https://slscan.io/en/latest/integrations/code-scan for help
name: SL Scan

# This section configures the trigger for the workflow. Feel free to customize depending on your convention
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

jobs:
  Scan-Build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/[email protected]
      with:
        fetch-depth: 0

    - name: Perform Scan
      uses: ShiftLeftSecurity/[email protected]
      env:
        WORKSPACE: ""
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SCAN_AUTO_BUILD: true
      with:
        output: reports

    - name: Upload report
      uses: github/codeql-action/[email protected]
      with:
        sarif_file: reports