|
|
|
@ -5,6 +5,7 @@ on:
|
|
|
|
|
branches:
|
|
|
|
|
- main
|
|
|
|
|
- release/**
|
|
|
|
|
- zalimeni/enable-security-scans-release--test
|
|
|
|
|
pull_request:
|
|
|
|
|
branches:
|
|
|
|
|
- main
|
|
|
|
@ -66,7 +67,7 @@ jobs:
|
|
|
|
|
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
|
|
|
|
|
with:
|
|
|
|
|
repository: hashicorp/security-scanner
|
|
|
|
|
token: ${{ secrets.ELEVATED_GITHUB_TOKEN }} #TODO replace w/ security-provided secret
|
|
|
|
|
token: ${{ secrets.HASHIBOT_PRODSEC_GITHUB_TOKEN }} #TODO replace w/ security-provided secret
|
|
|
|
|
path: security-scanner
|
|
|
|
|
ref: main
|
|
|
|
|
|
|
|
|
@ -79,8 +80,6 @@ jobs:
|
|
|
|
|
|
|
|
|
|
- name: SARIF Output
|
|
|
|
|
shell: bash
|
|
|
|
|
env:
|
|
|
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
|
run: |
|
|
|
|
|
cat results.sarif | jq
|
|
|
|
|
|
|
|
|
|