security-scan.yml

name: Security Scan

on:
  push:
    branches:
      - main
      - release/**
  pull_request:
    branches:
      - main
      - release/**
    paths-ignore:
      - 'assets/**'
      - '.changelog/**'

# cancel existing runs of the same workflow on the same ref
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:

  get-go-version:
    # Cascades down to test jobs
    uses: ./.github/workflows/reusable-get-go-version.yml

  scan:
    needs:
      - get-go-version
    runs-on: ubuntu-latest
    # The first check ensures this doesn't run on community-contributed PRs, who
    # won't have the permissions to run this job.
    if: ${{ (github.repository != 'hashicorp/consul-k8s' || (github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name))
      && (github.actor != 'dependabot[bot]') && (github.actor != 'hc-github-team-consul-core') }}

    steps:
      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4

      - name: Set up Go
        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: ${{ needs.get-go-version.outputs.go-version }}

      - name: Clone Security Scanner repo
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
        with:
          repository: hashicorp/security-scanner
          token: ${{ secrets.PRODSEC_SCANNER_READ_ONLY }}
          path: security-scanner
          ref: main

      - name: Scan
        id: scan
        uses: ./security-scanner
        with:
          repository: "$PWD"
          # See scan.hcl at repository root for config.

      - name: SARIF Output
        shell: bash
        run: |
          cat results.sarif | jq

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@c4fb451437765abf5018c6fbf22cce1a7da1e5cc # codeql-bundle-v2.17.1
        with:
          sarif_file: results.sarif