Add CodeQL scanning to CI

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
fluxcd · Mar 15, 2021 · 5ce0db3 · 5ce0db3
1 parent 95c2f1d
commit 5ce0db3
Show file tree

Hide file tree

Showing 2 changed files with 37 additions and 25 deletions.
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
@@ -0,0 +1,37 @@
+name: Scan
+
+on:
+ push:
+ branches: [ main ]
+ pull_request:
+ branches: [ main ]
+ schedule:
+ - cron: '18 10 * * 3'
+
+jobs:
+ fossa:
+ name: FOSSA
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v2
+ - name: Run FOSSA scan and upload build data
+ uses: fossa-contrib/fossa-action@v1
+ with:
+ # FOSSA Push-Only API Token
+ fossa-api-key: 5ee8bf422db1471e0bcf2bcb289185de
+ github-token: ${{ github.token }}
+
+ codeql:
+ name: CodeQL
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v2
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@v1
+ with:
+ languages: go
+ - name: Autobuild
+ uses: github/codeql-action/autobuild@v1
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@v1