vulnerability-scan.yml

---
name: Vulnerability Scan

on:
  schedule:
    - cron: "30 2 * * *"
  workflow_dispatch:

permissions: {}

jobs:
  vulnerability-scan:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        flavor: ["cpp", "rust"]
    permissions:
      security-events: write
    steps:
      - uses: crazy-max/ghaction-container-scan@3e9c23f89cd6b0bda949ffe14f28a3ce282323b7 # v3.0.0
        id: scan
        with:
          image: ghcr.io/${{ github.repository }}-${{ matrix.flavor }}:latest
          dockerfile: .devcontainer/Dockerfile
      - uses: github/codeql-action/upload-sarif@5cf07d8b700b67e235fbb65cbc84f69c0cf10464 # v3.25.14
        if: steps.scan.outputs.sarif != ''
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}