security_checks.yml

name: "[auto] Security Checks"
on:
  schedule:
    - cron: '0 6 * * *'
  push:
    branches:
      - dev
      - feature/*
  workflow_call:
    inputs:
      continue-on-error:
        type: boolean
        required: false
        default: false
permissions: {}
jobs:
  sdl:
    continue-on-error: ${{ inputs.continue-on-error || false }}
    name: SDL Compliance Checks
    runs-on: windows-latest
    permissions:
      # needed to write security info to repository
      security-events: write
      contents: read
    steps:
    - uses: actions/checkout@v4

      # Install dotnet, used by MSDO
    - uses: actions/setup-dotnet@v4
      with:
        dotnet-version: |
          5.0.x
          6.0.x

      # Run analyzers
    - name: Run Microsoft Security DevOps Analysis
      uses: microsoft/security-devops-action@v1
      id: msdo
      env:
        # file path to analyze
        GDN_BANDIT_TARGET: 'azext_iot'
        GDN_BANDIT_RECURSIVE: true

      # Upload alerts to the Security tab
    - name: Upload alerts to Security tab
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: ${{ steps.msdo.outputs.sarifFile }}

      # Upload alerts file as a workflow artifact
    - name: Upload alerts artifact
      uses: actions/upload-artifact@v4
      with:  
        name: alerts
        path: ${{ steps.msdo.outputs.sarifFile }}