report.yml

---
name: Reporting

on:
  push:
    branches:
      - devel
      - release-*

permissions: {}

jobs:
  vulnerability-scan:
    name: Vulnerability Scanning
    if: github.repository_owner == 'submariner-io'
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - name: Check out the repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
      - name: Run Anchore vulnerability scanner
        uses: anchore/scan-action@d43cc1dfea6a99ed123bf8f3133f1797c9b44492
        id: scan
        with:
          path: "."
          fail-build: false
      - name: Show Anchore scan SARIF report
        run: cat ${{ steps.scan.outputs.sarif }}
      - name: Upload Anchore scan SARIF report
        uses: github/codeql-action/upload-sarif@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}