Add MobSF workflow for mobile security scanning - #288
Conversation
This workflow automates the MobSF security scanning process on push and pull request events to the main branch, as well as on a weekly schedule.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| permissions: | ||
| contents: read # for actions/checkout to fetch code | ||
| security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | ||
| actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status |
There was a problem hiding this comment.
This job runs on pull_request but also requests security-events: write; on forks GitHub forces the GITHUB_TOKEN to read-only, so upload-sarif will return 403 and the workflow fails without publishing MobSF results for any forked PR. Consider gating the scan to non-fork PRs or moving the SARIF upload to a trusted context (e.g., pull_request_target or a workflow_run) so fork contributions don’t constantly break the CI scan.
Useful? React with 👍 / 👎.
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
This workflow automates the MobSF security scanning process on push and pull request events to the main branch, as well as on a weekly schedule.