sast.yml

---
name: "sast"

on:
    pull_request:
        branches:
            - "main"
    push:
        branches:
            - "main"
    schedule:
        - cron: "19 19 * * 4"

permissions: "read-all"

jobs:
    ossf:
        runs-on: "ubuntu-latest"
        # ossf scorecard only supported on main branch
        if: github.event_name != 'pull_request'
        permissions:
            security-events: "write"
            id-token: "write"
            contents: "read"
            actions: "read"
        steps:
            - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
              with:
                  persist-credentials: false
            - uses: "ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46"
              with:
                  results_file: "results.sarif"
                  results_format: "sarif"
                  publish_results: true
            - uses: "actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08"
              with:
                  name: "SARIF file"
                  path: "results.sarif"
                  retention-days: 5
            - uses: "github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c"
              with:
                  sarif_file: "results.sarif"

    codeql:
        runs-on: "ubuntu-latest"

        permissions:
            actions: read
            contents: read
            security-events: write

        steps:
            - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
            - uses: "github/codeql-action/init@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c"
              with:
                  languages: "typescript"
            - uses: "pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2"
              with:
                  version: "latest"
            - uses: "actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af"
              with:
                  node-version-file: ".nvmrc"
                  cache: "pnpm"
            - run: "make install"
            - uses: "github/codeql-action/analyze@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c"