mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-05-17 04:52:23 +00:00
af4ced32f4
It is good practice to add concurrency limits to automatically cancel jobs that have been superceded and potentially stop race conditions if we try and get artifacts by workflows and job id rather than run id. See https://docs.zizmor.sh/audits/#concurrency-limits Assisted-by: IBM Bob Signed-off-by: stevenhorsman <steven@uk.ibm.com>
50 lines
1.7 KiB
YAML
50 lines
1.7 KiB
YAML
# A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities,
|
|
# in addition to a PR check which fails if new vulnerabilities are introduced.
|
|
#
|
|
# For more examples and options, including how to ignore specific vulnerabilities,
|
|
# see https://google.github.io/osv-scanner/github-action/
|
|
|
|
name: OSV-Scanner
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
pull_request:
|
|
branches: [ "main" ]
|
|
schedule:
|
|
- cron: '0 1 * * 0'
|
|
push:
|
|
branches: [ "main" ]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-osv-scanner
|
|
cancel-in-progress: true
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
scan-scheduled:
|
|
name: Scan of whole repo
|
|
permissions:
|
|
actions: read # # Required to upload SARIF file to CodeQL
|
|
contents: read # Read commit contents
|
|
security-events: write # Require writing security events to upload SARIF file to security tab
|
|
if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
|
|
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@8ae4be80636b94886b3c271caad730985ce0611c" # v2.3.3
|
|
with:
|
|
scan-args: |-
|
|
-r
|
|
./
|
|
scan-pr:
|
|
name: Scan of just PR code
|
|
permissions:
|
|
actions: read # Required to upload SARIF file to CodeQL
|
|
contents: read # Read commit contents
|
|
security-events: write # Require writing security events to upload SARIF file to security tab
|
|
if: ${{ github.event_name == 'pull_request' }}
|
|
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@8ae4be80636b94886b3c271caad730985ce0611c" # v2.3.3
|
|
with:
|
|
# Example of specifying custom arguments
|
|
scan-args: |-
|
|
-r
|
|
./
|