Skip to content

Security

Security #67

Workflow file for this run

name: Security
on:
push:
branches: ["master"]
paths-ignore:
- "*.md"
pull_request:
branches: ["master"]
paths-ignore:
- "*.md"
schedule:
- cron: "0 12 * * 0"
workflow_dispatch:
jobs:
eslint:
name: Run ESLint scanning
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps:
- uses: actions/checkout@v3
- name: Install dependencies
run: npm ci --no-fund
- name: Run ESLint
run: npm run security:eslint
- name: Upload analysis results to GitHub
uses: github/codeql-action/upload-sarif@v2
if: success() || failure() # Run this step even if previous step failed.
with:
sarif_file: eslint-results.sarif
wait-for-processing: true
codeql:
name: Run CodeQL scanning
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- uses: actions/checkout@v3
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: typescript
- name: Auto-build by CodeQL
uses: github/codeql-action/autobuild@v2
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
sonarcloud:
name: Run SonarCloud scanning
runs-on: ubuntu-latest
permissions:
pull-requests: read # Allows SonarCloud to decorate PRs with analysis results.
steps:
- uses: actions/setup-java@v4
with:
distribution: "temurin"
java-version: "21" # SonarCloud requires v17 or higher.
check-latest: true
- uses: actions/checkout@v3
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis.
- name: Install dependencies
run: npm ci --no-fund
- name: Test and coverage
run: npm run test
- name: SonarCloud Scan
uses: sonarsource/sonarcloud-github-action@master
if: success() || failure() # Run this step even if previous step failed.
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
with:
args: >
-Dsonar.projectKey=jerone_eslint-formatter-checklist
-Dsonar.organization=jerone
-Dsonar.projectBaseDir=.
-Dsonar.sources=./src/
-Dsonar.tests=./tests/
-Dsonar.javascript.lcov.reportPaths=./coverage/lcov.info
codecov:
name: Run Codecov scanning
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis.
- name: Install dependencies
run: npm ci --no-fund
- name: Test and coverage
run: npm run test
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v3
if: success() || failure() # Run this step even if previous step failed.