name: Codacy Security Scan
on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
schedule:
- cron: "42 12 * * 0"
permissions:
contents: read
jobs:
codacy-security-scan:
name: Codacy Security Scan
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
actions: read
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
submodules: false
- name: Cleanup stray advisory-db submodule residue
run: |
git config --global --add safe.directory "$GITHUB_WORKSPACE"
git submodule deinit -f --all || true
rm -rf .git/modules/cargo-home/advisory-db || true
rm -rf cargo-home/advisory-db || true
- name: Run Codacy Analysis CLI
uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b
with:
project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
verbose: true
output: results.sarif
format: sarif
gh-code-scanning-compat: true
max-allowed-issues: 2147483647
- name: Upload SARIF results file
uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: results.sarif
category: codacy