TestingSecretsRepo/.github/workflows/scan.yml at main · endorlabs/TestingSecretsRepo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
name: Scan
# test

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  scan:
    permissions:
      security-events: write
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Repository
      uses: actions/checkout@v3
    - name: Setup Java
      uses: actions/setup-java@v3
      with:
        distribution: 'microsoft'
        java-version: '17'
    - name: Compile Package
      run: mvn clean install
    - name: Run endorctl
      uses: endorlabs/github-action@74d70ba37def0b8747152207bf33b29df9628453
      with:
        namespace: "diamantis"
        api: "https://api.staging.endorlabs.com"
        enable_github_action_token: "true"
        github_token: ${{ secrets.GITHUB_TOKEN }}
        sarif_file: findings.sarif
        additional_args: "--enable=git,analytics,secrets"
    - name: Upload SARIF to github
      uses: github/codeql-action/upload-sarif@9885f86fab4879632b7e44514f19148225dfbdcd
      with:
        sarif_file: findings.sarif