mirror of
https://github.com/nlohmann/json.git
synced 2026-10-03 13:10:33 +00:00
Niels Lohmann
a9ab2a62ba
Ubuntu, Windows, macOS, and CodeQL already cancel an older run of the same workflow on the same ref. Check amalgamation, CIFuzz, Dependency Review, Flawfinder, Semgrep, Scorecard, and the labeler did not, so every push to a pull request left their earlier runs going. Give them the same concurrency group. The labeler runs on pull_request_target, where github.ref is the base branch, so it groups by pull request number. Signed-off-by: Niels Lohmann <mail@nlohmann.me>
53 lines
1.5 KiB
YAML
53 lines
1.5 KiB
YAML
# This workflow uses actions that are not certified by GitHub.
|
|
# They are provided by a third-party and are governed by
|
|
# separate terms of service, privacy policy, and support
|
|
# documentation.
|
|
|
|
name: flawfinder
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
push:
|
|
branches: [ "develop" ]
|
|
pull_request:
|
|
# The branches below must be a subset of the branches above
|
|
branches: [ "develop" ]
|
|
schedule:
|
|
- cron: '41 14 * * 3'
|
|
|
|
jobs:
|
|
flawfinder:
|
|
name: Flawfinder
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
security-events: write
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: flawfinder_scan
|
|
uses: david-a-wheeler/flawfinder@c4216b74cf2639ffa98503768bd6e4299b5440c9 # v2.0.20
|
|
with:
|
|
arguments: '--sarif ./'
|
|
output: 'flawfinder_results.sarif'
|
|
|
|
- name: Upload analysis results to GitHub Security tab
|
|
uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
|
|
with:
|
|
sarif_file: ${{github.workspace}}/flawfinder_results.sarif
|