ci: add bearer workflow (#141)

* ci: add bearer workflow Signed-off-by: Dwi Siswanto <[email protected]> * ci(tests): call bearer workflow Signed-off-by: Dwi Siswanto <[email protected]> --------- Signed-off-by: Dwi Siswanto <[email protected]>
teler-sh · Jan 5, 2024 · ec6340c · ec6340c
1 parent 332dbc5
commit ec6340c
Show file tree

Hide file tree

Showing 2 changed files with 47 additions and 0 deletions.
diff --git a/.github/workflows/bearer.yaml b/.github/workflows/bearer.yaml
@@ -0,0 +1,41 @@
+name: "Bearer"
+
+on:
+  workflow_call:
+    inputs:
+      diff:
+        description: 'Enable differential scanning.'
+        default: false
+        required: false
+        type: boolean
+
+jobs:
+  bearer:
+    name: Bearer Scan
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: reviewdog/action-setup@v1
+        with:
+          reviewdog_version: latest
+
+      - name: Bearer
+        uses: bearer/bearer-action@v2
+        with:
+          format: rdjson
+          output: rd.json
+          diff: ${{ inputs.diff }}
+          severity: high,critical
+          skip-path: examples/
+          exit-code: 1
+
+      - name: Run reviewdog
+        if: inputs.diff == true
+        env:
+          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: cat rd.json | reviewdog -f=rdjson -reporter=github-pr-review
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
@@ -78,6 +78,12 @@ jobs:
     needs: tests
     uses: ./.github/workflows/codeql.yaml
 
+  bearer:
+    needs: tests
+    uses: ./.github/workflows/bearer.yaml
+    with:
+      diff: ${{ github.event_name == 'pull_request' && true || false }}
+
   regression:
     needs: tests
     uses: ./.github/workflows/regression.yaml