From 52ee7dee2bcbc74d94eba2b21b5982b241e27d16 Mon Sep 17 00:00:00 2001
From: Sergey Nebolsin <nebolsin@gmail.com>
Date: Sat, 24 Jun 2023 05:13:10 +0300
Subject: [PATCH] chore(security): add Codacy scan

---
 .github/workflows/ci.yml       |  8 +++++++-
 .github/workflows/security.yml | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e98fa1a4..35e5cb18 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,7 +60,13 @@ jobs:
         debug: true
       if: success()
       continue-on-error: true
-
+    - name: Upload code coverage data to Codacy
+      uses: codacy/codacy-coverage-reporter-action@v1
+      with:
+        project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
+        coverage-reports: coverage/lcov.info
+      if: success()
+      continue-on-error: true
   lint:
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 064d1e05..62ca147e 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -35,6 +35,38 @@ jobs:
       with:
         category: "/language:${{matrix.language}}"
 
+  codacy-security-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    name: Codacy Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout the repository to the GitHub Actions runner
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
+      - name: Run Codacy Analysis CLI
+        uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b
+        with:
+          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
+          verbose: true
+          output: results.sarif
+          format: sarif
+          # Adjust severity of non-security issues
+          gh-code-scanning-compat: true
+          # Force 0 exit code to allow SARIF file generation
+          # This will handover control about PR rejection to the GitHub side
+          max-allowed-issues: 2147483647
+
+      # Upload the SARIF file generated in the previous step
+      - name: Upload SARIF results file
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: results.sarif
+
   semgrep:
     name: Scan with Semgrep
     # Skip any PR created by dependabot to avoid permission issues