From 141a708cff04c453a43aba0590858553388ce756 Mon Sep 17 00:00:00 2001 From: Niels Lohmann Date: Mon, 26 Oct 2026 08:21:42 +0100 Subject: [PATCH] Use flawfinder --exclude instead of listing directories Flawfinder 2.0.20 has an --exclude PATTERN option. Scan `./` and exclude `*/single_include/*` so that new top-level directories are covered automatically. The scanned file set is identical to the explicit directory list. Signed-off-by: Niels Lohmann --- .github/workflows/flawfinder.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/flawfinder.yml b/.github/workflows/flawfinder.yml index 2aebc6306..0c6e5fa9c 100644 --- a/.github/workflows/flawfinder.yml +++ b/.github/workflows/flawfinder.yml @@ -43,8 +43,8 @@ jobs: - name: flawfinder_scan uses: david-a-wheeler/flawfinder@c4216b74cf2639ffa98503768bd6e4299b5440c9 # v2.0.20 with: - # single_include/ is omitted: it is generated from include/ and would report every finding twice - arguments: '--sarif ./cmake ./docs ./include ./src ./tests ./tools' + # single_include/ is generated from include/ and would report every finding twice + arguments: "--sarif --exclude '*/single_include/*' ./" output: 'flawfinder_results.sarif' - name: Upload analysis results to GitHub Security tab