scanner.yml

# Scan code for security vulnerabilities using clj-holmes
name: Static Code Analysis

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]
  schedule:
    - cron: '43 11 * * 3'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  clj-holmes:
    # This job is intended to run on Wall Brew Co repositories only
    if: github.repository_owner == 'Wall-Brew-Co'
    name: Run clj-holmes scanning
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Echo Trigger
        id: echo-trigger
        run: echo "Job triggered by ${{ github.event_name }}"

      - name: Echo Runner OS
        id: echo-runner-os
        run: echo "Job running on ${{ runner.os }} server"

      - name: Echo Git Ref
        id: echo-git-ref
        run: echo "Using ${{ github.ref }} branch from ${{ github.repository }} repository"

      - name: Checkout Repository
        id: checkout
        uses: actions/checkout@v4.2.2

      - name: Scan Code
        id: scan
        uses: clj-holmes/clj-holmes-action@53daa4da4ff495cccf791e4ba4222a8317ddae9e
        with:
          output-type: 'sarif'
          output-file: 'clj-holmes-results.sarif'
          fail-on-result: 'false'

      - name: Upload Analysis Results To GitHub Security Tab
        id: upload-results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{github.workspace}}/clj-holmes-results.sarif

      - name: Echo Status
        id: echo-status
        run: echo "Job status is ${{ job.status }}."

# This file was automatically copied and populated by rebroadcast
# Do not edit this file directly, instead modify the source at https://github.com/Wall-Brew-Co/rebroadcast/blob/master/sources/github-actions/workflows/scanner.yml