pipeline.yml

# workflow name
name: CLI Pipeline

# define when the workflow should be triggered
# this workflow is triggered on any push to any branch
# and on pull requests with specific events
on:
  push:
    branches: ["*"]
  pull_request:
    branches: ["*"]
    types:
      - opened
      - edited
      - reopened
      - synchronize

# permissions required for the workflow
# the workflow needs read permissions for repository contents and packages
permissions:
  contents: read
  packages: read

# define jobs to be run
jobs:
  # job to checkout the repository and set up the environment
  checkout-and-setup:
    name: "1. Checkout and Setup"
    runs-on: ubuntu-latest
    outputs:
      # output of the checkout step
      checkout-dir: ${{ steps.checkout.outputs.dir }}
    steps:
      - name: Checkout Repository
        id: checkout
        uses: actions/checkout@v4
        with:
          # fetch all history for all branches and tags
          fetch-depth: 0

  # ===============

  # job to run a security scan using gitleaks
  security-scan:
    name: "2. Run Security Scan"
    # depends on the completion of the checkout-and-setup job
    needs: checkout-and-setup
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          # fetch all history for all branches and tags
          fetch-depth: 0
      - name: Run Security Scanner
        uses: gitleaks/gitleaks-action@v2
        env:
          # token for accessing the GitHub API
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}