ci: enable gosec sarif upload (evmos#776)

* ci: enable gosec sarif upload * Update .github/workflows/security.yml Co-authored-by: Federico Kunze Küllmer <[email protected]>
leejw51crypto · Nov 30, 2021 · dc01387 · dc01387
1 parent 6e74661
commit dc01387
Showing 1 changed file with 18 additions and 18 deletions.
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
@@ -1,34 +1,34 @@
 name: Run Gosec
 on:
+  pull_request:
   push:
     branches:
       - main
-  pull_request:
-    branches:
-      - '**'
+
 jobs:
-  tests:
+  Gosec:
     runs-on: ubuntu-latest
     env:
       GO111MODULE: on
     steps:
       - name: Checkout Source
         uses: actions/[email protected]
-      # - uses: technote-space/get-diff-action@v5
-      #   with:
-      #     SUFFIX_FILTER: |
-      #       .go
-      #       .mod
-      #       .sum
+      - name: Get Diff
+        uses: technote-space/get-diff-action@v5
+        with:
+          PATTERNS: |
+            **/*.go
+            go.mod
+            go.sum
       - name: Run Gosec Security Scanner
         uses: informalsystems/gosec@master
         with:
-          args: ./...
           # we let the report trigger content trigger a failure using the GitHub Security features.
-      #     args: '-no-fail -fmt sarif -out results.sarif ./...'
-      # - name: Upload SARIF file
-      #   uses: github/codeql-action/upload-sarif@v1
-      #   with:
-      #     # Path to SARIF file relative to the root of the repository
-      #     sarif_file: results.sarif
-        # if: "env.GIT_DIFF != ''"
+          args: '-no-fail -fmt sarif -out results.sarif ./...'
+        if: "env.GIT_DIFF_FILTERED != ''"
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          # Path to SARIF file relative to the root of the repository
+          sarif_file: results.sarif
+        if: "env.GIT_DIFF_FILTERED != ''"