From 8ffc7bd69101f1235339c810a94f6ac8e86138a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=A2=E2=80=A2jQ=E2=80=A2=E2=80=A2?= Date: Fri, 26 Feb 2021 20:59:01 -0600 Subject: [PATCH] Create njsscan-analysis.yml --- .github/workflows/njsscan-analysis.yml | 30 ++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/njsscan-analysis.yml diff --git a/.github/workflows/njsscan-analysis.yml b/.github/workflows/njsscan-analysis.yml new file mode 100644 index 0000000..e0c9fc0 --- /dev/null +++ b/.github/workflows/njsscan-analysis.yml @@ -0,0 +1,30 @@ +# This workflow integrates njsscan with GitHub's Code Scanning feature +# nodejsscan is a static security code scanner that finds insecure code patterns in your Node.js applications + +name: njsscan sarif + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '42 17 * * 1' + +jobs: + njsscan: + runs-on: ubuntu-latest + name: njsscan code scanning + steps: + - name: Checkout the code + uses: actions/checkout@v2 + - name: nodejsscan scan + id: njsscan + uses: ajinabraham/njsscan-action@master + with: + args: '. --sarif --output results.sarif || true' + - name: Upload njsscan report + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: results.sarif