Merge pull request #1385 from metal3-io/renovate/github-codeql-action… #392

	name: Kubesec
	on:
	push:
	branches: [ main ]
	schedule:
	- cron: '30 7 * * 2'

	permissions:
	contents: read

	jobs:
	setup:
	runs-on: ubuntu-22.04
	permissions:
	actions: read
	contents: read
	steps:
	- name: Checkout code
	uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

	- name: Collect all yaml
	id: list_yaml
	run: \|
	LIST_YAML="$(find * -type f -name '.yaml' ! -path '/templates/*')"
	echo "::set-output name=value::$(IFS=$','; echo $LIST_YAML \| jq -cnR '[inputs \| select(length>0)]'; IFS=$'\n')"
	outputs:
	matrix: ${{ steps.list_yaml.outputs.value }}

	lint:
	needs: [ setup ]
	name: Kubesec
	runs-on: ubuntu-22.04
	permissions:
	actions: read
	contents: read
	security-events: write
	strategy:
	matrix:
	value: ${{ fromJson(needs.setup.outputs.matrix) }}
	steps:
	- name: Checkout code
	uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

	- name: Run kubesec scanner
	uses: controlplaneio/kubesec-action@43d0ddff5ffee89a6bb9f29b64cd865411137b14
	with:
	input: ${{ matrix.value }}
	format: template
	template: template/sarif.tpl
	output: ${{ matrix.value }}.sarif
	exit-code: "0"

	- name: Save result into a variable
	id: save_result
	run: echo "::set-output name=result::$(cat ${{ matrix.value }}.sarif \| jq -c '.runs')"

	- name: Upload Kubesec scan results to GitHub Security tab
	if: ${{ steps.save_result.outputs.result != '[]' }}
	uses: github/codeql-action/upload-sarif@df5a14dc28094dc936e103b37d749c6628682b60 # v3.25.0
	with:
	sarif_file: ${{ matrix.value }}.sarif

Provide feedback