security-scanners.yml

name: Security scanners

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]
jobs:
  run-scanners:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Ruby and install gems
        uses: ruby/setup-ruby@v1
        env:
          ImageOS: ubuntu20
        with:
          bundler-cache: true

      - name: Run security checks
        run: |
          bin/bundle exec brakeman -q --exit-on-warn --ensure-ignore-notes --ensure-latest

  notify_statuscope:
    uses: ./.github/workflows/notify-statuscope.yml
    needs: [ run-scanners ]
    if: ( success() || failure() ) && ( github.ref_name == 'master' )
    with:
      repository: 'hitobito-security'
      test_result: ${{ needs.run-scanners.result == 'success' }}
    secrets:
      HEARTBEAT_URL: ${{ secrets.HEARTBEAT_URL }}
      HEARTBEAT_TOKEN: ${{ secrets.HEARTBEAT_TOKEN_SECURITY }}