scan.yml

name: "Security Scan"

# Run workflow each time code is pushed to your repository and on a schedule.
# The scheduled workflow runs every at 00:00 on Sunday UTC time.
on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - "internal/**"
      - "pkg/**"
      - "cmd/**"
      - "*.go"
  pull_request:
    branches:
      - main
  schedule:
    - cron: "0 0 * * 0"

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code into the Go module directory
        uses: actions/checkout@v4

      - name: Security Scan
        uses: securego/gosec@master
        with:
          args: "-no-fail -fmt sarif -out results.sarif ./..."

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: results.sarif