From 2236281a789da568387928d56ddc0e86a0098a4d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20B=C3=A4hler?= Date: Thu, 19 Oct 2023 14:27:34 +0200 Subject: [PATCH] build(ci): release security and workflow updates --- .github/workflows/check-actions.yml | 24 +++++++ .github/workflows/check-commit.yml | 23 ++++++ .github/workflows/codecov.yml | 38 ++++++++++ .github/workflows/{ci.yml => diff.yml} | 31 +++----- .github/workflows/docker-ci.yml | 97 -------------------------- .github/workflows/docker-publish.yml | 69 ++++++++++++++++++ .github/workflows/docs-lint.yml | 9 ++- .github/workflows/e2e.yml | 13 ++-- .github/workflows/fossa.yml | 20 ++++-- .github/workflows/gosec.yml | 10 ++- .github/workflows/helm.yml | 86 ----------------------- .github/workflows/lint.yml | 25 +++++++ .github/workflows/releaser.yml | 36 ++++++++++ .github/workflows/scorecard.yml | 42 +++++++++++ 14 files changed, 304 insertions(+), 219 deletions(-) create mode 100644 .github/workflows/check-actions.yml create mode 100644 .github/workflows/check-commit.yml create mode 100644 .github/workflows/codecov.yml rename .github/workflows/{ci.yml => diff.yml} (61%) delete mode 100644 .github/workflows/docker-ci.yml create mode 100644 .github/workflows/docker-publish.yml delete mode 100644 .github/workflows/helm.yml create mode 100644 .github/workflows/lint.yml create mode 100644 .github/workflows/releaser.yml create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/check-actions.yml b/.github/workflows/check-actions.yml new file mode 100644 index 00000000..01eaa4c0 --- /dev/null +++ b/.github/workflows/check-actions.yml @@ -0,0 +1,24 @@ +name: Check actions +permissions: {} + +on: + pull_request: + branches: [ "main" ] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + check: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - name: Ensure SHA pinned actions + uses: zgosalvez/github-actions-ensure-sha-pinned-actions@f32435541e24cd6a4700a7f52bb2ec59e80603b1 # v2.1.4 + with: + # slsa-github-generator requires using a semver tag for reusable workflows. + # See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators + allowlist: | + slsa-framework/slsa-github-generator \ No newline at end of file diff --git a/.github/workflows/check-commit.yml b/.github/workflows/check-commit.yml new file mode 100644 index 00000000..0d6b52a2 --- /dev/null +++ b/.github/workflows/check-commit.yml @@ -0,0 +1,23 @@ +name: Check Commit +permissions: {} + +on: + push: + branches: [ "*" ] + pull_request: + branches: [ "*" ] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + commit_lint: + runs-on: ubuntu-20.04 + steps: + - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + with: + fetch-depth: 0 + - uses: wagoid/commitlint-github-action@6319f54d83768b60acd6fd60e61007ccc583e62f #v5.4.3 + with: + firstParent: true diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml new file mode 100644 index 00000000..2d8834e0 --- /dev/null +++ b/.github/workflows/codecov.yml @@ -0,0 +1,38 @@ +name: Codecov +permissions: {} + +on: + pull_request: + branches: [ "main" ] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + codecov: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - name: Setup caches + uses: ./.github/actions/setup-caches + timeout-minutes: 5 + continue-on-error: true + with: + build-cache-key: codecov + - name: Check secret + id: checksecret + uses: ./.github/actions/exists + with: + value: ${{ secrets.CODECOV_TOKEN }} + - name: Generate Code Coverage Report + if: steps.checksecret.outputs.result == 'true' + run: make test + - name: Upload Report to Codecov + if: steps.checksecret.outputs.result == 'true' + uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4 + with: + file: ./coverage.out + fail_ci_if_error: true + verbose: true diff --git a/.github/workflows/ci.yml b/.github/workflows/diff.yml similarity index 61% rename from .github/workflows/ci.yml rename to .github/workflows/diff.yml index cc15c588..4d479023 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/diff.yml @@ -1,4 +1,5 @@ -name: CI +name: Diff checks +permissions: {} on: push: @@ -6,35 +7,19 @@ on: pull_request: branches: [ "*" ] +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: - commit_lint: - runs-on: ubuntu-20.04 - steps: - - uses: actions/checkout@v2 - with: - fetch-depth: 0 - - uses: wagoid/commitlint-github-action@v2 - with: - firstParent: true - golangci: - name: lint - runs-on: ubuntu-20.04 - steps: - - uses: actions/checkout@v2 - - name: Run golangci-lint - uses: golangci/golangci-lint-action@v2.3.0 - with: - version: v1.51.2 - only-new-issues: false - args: --timeout 5m --config .golangci.yml diff: name: diff runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 with: fetch-depth: 0 - - uses: actions/setup-go@v2 + - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.19' - run: make installer diff --git a/.github/workflows/docker-ci.yml b/.github/workflows/docker-ci.yml deleted file mode 100644 index da2cbec0..00000000 --- a/.github/workflows/docker-ci.yml +++ /dev/null @@ -1,97 +0,0 @@ -name: docker-ci - -on: - push: - tags: - - "v*" - -jobs: - docker-ci: - runs-on: ubuntu-20.04 - steps: - - - name: Checkout - uses: actions/checkout@v2 - - - name: Generate build-args - id: build-args - run: | - # Declare vars for internal use - VERSION=$(git describe --abbrev=0 --tags) - GIT_HEAD_COMMIT=$(git rev-parse --short HEAD) - GIT_TAG_COMMIT=$(git rev-parse --short $VERSION) - GIT_MODIFIED_1=$(git diff $GIT_HEAD_COMMIT $GIT_TAG_COMMIT --quiet && echo "" || echo ".dev") - GIT_MODIFIED_2=$(git diff --quiet && echo "" || echo ".dirty") - # Export to GH_ENV - echo "GIT_LAST_TAG=$VERSION" >> $GITHUB_ENV - echo "GIT_HEAD_COMMIT=$GIT_HEAD_COMMIT" >> $GITHUB_ENV - echo "GIT_TAG_COMMIT=$GIT_TAG_COMMIT" >> $GITHUB_ENV - echo "GIT_MODIFIED=$(echo "$GIT_MODIFIED_1""$GIT_MODIFIED_2")" >> $GITHUB_ENV - echo "GIT_REPO=$(git config --get remote.origin.url)" >> $GITHUB_ENV - echo "BUILD_DATE=$(git log -1 --format="%at" | xargs -I{} date -d @{} +%Y-%m-%dT%H:%M:%S)" >> $GITHUB_ENV - - - name: Docker meta - id: meta - uses: docker/metadata-action@v3 - with: - images: | - quay.io/${{ github.repository }} - docker.io/${{ github.repository }} - tags: | - type=semver,pattern={{raw}} - flavor: | - latest=false - - - name: Set up QEMU - id: qemu - uses: docker/setup-qemu-action@v1 - with: - platforms: arm64,arm - - - name: Set up Docker Buildx - id: buildx - uses: docker/setup-buildx-action@v1 - with: - install: true - - - name: Inspect builder - run: | - echo "Name: ${{ steps.buildx.outputs.name }}" - echo "Endpoint: ${{ steps.buildx.outputs.endpoint }}" - echo "Status: ${{ steps.buildx.outputs.status }}" - echo "Flags: ${{ steps.buildx.outputs.flags }}" - echo "Platforms: ${{ steps.buildx.outputs.platforms }}" - - - name: Login to quay.io Container Registry - uses: docker/login-action@v1 - with: - registry: quay.io - username: ${{ github.repository_owner }}+github - password: ${{ secrets.BOT_QUAY_IO }} - - - name: Login to docker.io Container Registry - uses: docker/login-action@v1 - with: - registry: docker.io - username: ${{ secrets.USER_DOCKER_IO }} - password: ${{ secrets.BOT_DOCKER_IO }} - - - name: Build and push - id: build-release - uses: docker/build-push-action@v2 - with: - file: Dockerfile - context: . - platforms: linux/amd64,linux/arm64,linux/arm - push: true - tags: ${{ steps.meta.outputs.tags }} - build-args: | - GIT_HEAD_COMMIT=${{ env.GIT_HEAD_COMMIT }} - GIT_TAG_COMMIT=${{ env.GIT_TAG_COMMIT }} - GIT_REPO=${{ env.GIT_REPO }} - GIT_LAST_TAG=${{ env.GIT_LAST_TAG }} - GIT_MODIFIED=${{ env.GIT_MODIFIED }} - BUILD_DATE=${{ env.BUILD_DATE }} - - - name: Image digest - run: echo ${{ steps.build-release.outputs.digest }} diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml new file mode 100644 index 00000000..ed7d8d0c --- /dev/null +++ b/.github/workflows/docker-publish.yml @@ -0,0 +1,69 @@ +name: Publish images +permissions: {} + +on: + push: + tags: + - "v*" + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + publish-images: + runs-on: ubuntu-latest + permissions: + packages: write + id-token: write + outputs: + capsule-digest: ${{ steps.publish-capsule.outputs.digest }} + steps: + - name: Checkout + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - name: Setup caches + uses: ./.github/actions/setup-caches + timeout-minutes: 5 + continue-on-error: true + with: + build-cache-key: publish-images + - name: Run Trivy vulnerability (Repo) + uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.12.0 + with: + scan-type: 'fs' + ignore-unfixed: true + format: 'sarif' + output: 'trivy-results.sarif' + severity: 'CRITICAL,HIGH' + - name: Install Cosign + uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2 + - name: Publish Capsule + id: publish-capsule + uses: oliverbaehler/github-actions/ko-publish-image@979018716f7d0cbe8d2711f572b350afad4ef211 # v0.1.1 + with: + makefile-target: ko-publish-capsule + registry: ghcr.io + registry-username: ${{ github.actor }} + registry-password: ${{ secrets.GITHUB_TOKEN }} + repository: ${{ github.repository_owner }} + version: ${{ github.ref_name }} + sign-image: true + sbom-name: capsule + sbom-repository: ghcr.io/${{ github.repository_owner }}/sbom + signature-repository: ghcr.io/${{ github.repository_owner }}/signatures + main-path: ./ + env: + REPOSITORY: ${{ github.repository }} + generate-capsule-provenance: + needs: publish-images + permissions: + id-token: write # To sign the provenance. + packages: write # To upload assets to release. + actions: read # To read the workflow path. + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0 + with: + image: ghcr.io/${{ github.repository_owner }}/capsule + digest: "${{ needs.publish-images.outputs.capsule-digest }}" + registry-username: ${{ github.actor }} + secrets: + registry-password: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/docs-lint.yml b/.github/workflows/docs-lint.yml index 168ece40..3876d20a 100644 --- a/.github/workflows/docs-lint.yml +++ b/.github/workflows/docs-lint.yml @@ -1,4 +1,5 @@ name: docs-lint +permissions: {} on: push: @@ -12,15 +13,19 @@ on: - '.github/workflows/docs-lint.yml' - 'docs/content/**' +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: spelling: name: Spell Check runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 with: fetch-depth: 0 - - uses: actions/setup-node@v3 + - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version: 18 - run: make docs-lint \ No newline at end of file diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 61840464..f4cf72f8 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,4 +1,5 @@ name: e2e +permissions: {} on: push: @@ -26,6 +27,10 @@ on: - 'main.go' - 'Makefile' +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: kind: name: Kubernetes @@ -35,10 +40,10 @@ jobs: k8s-version: ['v1.20.7', 'v1.21.2', 'v1.22.4', 'v1.23.6', 'v1.24.7', 'v1.25.3', 'v1.26.3', 'v1.27.2'] runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 with: fetch-depth: 0 - - uses: actions/setup-go@v2 + - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.19' - run: make manifests @@ -46,11 +51,11 @@ jobs: run: test -z "$(git diff 2> /dev/null)" - name: Checking if manifests generated untracked files run: test -z "$(git ls-files --others --exclude-standard 2> /dev/null)" - - uses: engineerd/setup-kind@v0.5.0 + - uses: engineerd/setup-kind@aa272fe2a7309878ffc2a81c56cfe3ef108ae7d0 # v0.5.0 with: skipClusterCreation: true version: v0.14.0 - - uses: azure/setup-helm@v1 + - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3 with: version: 3.3.4 - name: e2e testing diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index e1d36324..75ed8ddf 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -1,4 +1,5 @@ name: FOSSA +permissions: {} on: push: @@ -6,20 +7,29 @@ on: pull_request: branches: [ "*" ] +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: fossa-scan: runs-on: ubuntu-20.04 steps: - name: "Checkout Code" - uses: actions/checkout@v3 - + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - name: Check secret + id: checksecret + uses: ./.github/actions/exists + with: + value: ${{ secrets.FOSSA_API_KEY }} - name: "Run FOSSA Scan" - uses: fossas/fossa-action@v1.3.1 + if: steps.checksecret.outputs.result == 'true' + uses: fossas/fossa-action@f61a4c0c263690f2ddb54b9822a719c25a7b608f # v1.3.1 with: api-key: ${{ secrets.FOSSA_API_KEY }} - - name: "Run FOSSA Test" - uses: fossas/fossa-action@v1.3.1 + if: steps.checksecret.outputs.result == 'true' + uses: fossas/fossa-action@f61a4c0c263690f2ddb54b9822a719c25a7b608f # v1.3.1 with: api-key: ${{ secrets.FOSSA_API_KEY }} run-tests: true diff --git a/.github/workflows/gosec.yml b/.github/workflows/gosec.yml index 6c886d20..a0df44a7 100644 --- a/.github/workflows/gosec.yml +++ b/.github/workflows/gosec.yml @@ -1,9 +1,15 @@ name: CI gosec +permissions: {} on: push: branches: [ "*" ] pull_request: branches: [ "*" ] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: tests: runs-on: ubuntu-20.04 @@ -11,8 +17,8 @@ jobs: GO111MODULE: on steps: - name: Checkout Source - uses: actions/checkout@v2 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: Run Gosec Security Scanner - uses: securego/gosec@master + uses: securego/gosec@0ec6cd95d7bf02aef4ec2786e884868e0044875b # v2.18.1 with: args: ./... diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml deleted file mode 100644 index 539dd1a4..00000000 --- a/.github/workflows/helm.yml +++ /dev/null @@ -1,86 +0,0 @@ -name: Helm Chart - -on: - push: - branches: [ "*" ] - tags: [ "helm-v*" ] - pull_request: - branches: [ "*" ] - -jobs: - lint: - runs-on: ubuntu-20.04 - steps: - - uses: actions/checkout@v2 - with: - fetch-depth: 0 - - uses: azure/setup-helm@v1 - with: - version: 3.3.4 - - name: Linting Chart - run: helm lint ./charts/capsule - - name: Setup Chart Linting - id: lint - uses: helm/chart-testing-action@v2.3.0 - - name: Run chart-testing (list-changed) - id: list-changed - run: | - changed=$(ct list-changed --config ./.github/configs/ct.yaml) - if [[ -n "$changed" ]]; then - echo "::set-output name=changed::true" - fi - - name: Run chart-testing (lint) - run: ct lint --debug --config ./.github/configs/ct.yaml --lint-conf ./.github/configs/lintconf.yaml - - name: Run docs-testing (helm-docs) - id: helm-docs - run: | - make helm-docs - if [[ $(git diff --stat) != '' ]]; then - echo -e '\033[0;31mDocumentation outdated! (Run make helm-docs locally and commit)\033[0m ❌' - git diff --color - exit 1 - else - echo -e '\033[0;32mDocumentation up to date\033[0m ✔' - fi - - # ATTENTION: This is a workaround for the upcoming ApiVersion Conversions for the capsule CRDs - # With this workflow the current docker image is build and loaded into kind, otherwise the install fails - # In the future this must be removed and the chart-testing-action must be used - - name: Run chart-testing (install) - run: make helm-test - if: steps.list-changed.outputs.changed == 'true' - - ## Create KIND Cluster - #- name: Create kind cluster - # uses: helm/kind-action@v1.2.0 - # if: steps.list-changed.outputs.changed == 'true' - ## Install Required Operators/CRDs - #- name: Prepare Cluster Operators/CRDs - # run: | - # # Cert-Manager CRDs - # kubectl create -f https://github.com/cert-manager/cert-manager/releases/download/v1.9.1/cert-manager.crds.yaml - # - # # Prometheus CRDs - # kubectl create -f https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.58.0/bundle.yaml - # if: steps.list-changed.outputs.changed == 'true' - ## Install Charts - #- name: Run chart-testing (install) - # run: ct install --debug --config ./.github/configs/ct.yaml - # if: steps.list-changed.outputs.changed == 'true' - release: - if: startsWith(github.ref, 'refs/tags/helm-v') - runs-on: ubuntu-20.04 - steps: - - uses: actions/checkout@v2 - - name: Publish Helm chart - uses: stefanprodan/helm-gh-pages@master - with: - token: ${{ secrets.BOT_GITHUB_TOKEN }} - charts_dir: charts - charts_url: https://clastix.github.io/charts - owner: clastix - repository: charts - branch: gh-pages - target_dir: . - commit_username: prometherion - commit_email: dario@tranchitella.eu diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml new file mode 100644 index 00000000..ae0f11b8 --- /dev/null +++ b/.github/workflows/lint.yml @@ -0,0 +1,25 @@ +name: Linting +permissions: {} + +on: + push: + branches: [ "*" ] + pull_request: + branches: [ "*" ] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + golangci: + name: lint + runs-on: ubuntu-20.04 + steps: + - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - name: Run golangci-lint + uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0 + with: + version: v1.51.2 + only-new-issues: false + args: --timeout 5m --config .golangci.yml diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml new file mode 100644 index 00000000..e7a7b2cd --- /dev/null +++ b/.github/workflows/releaser.yml @@ -0,0 +1,36 @@ +name: Go Release + +permissions: {} +on: + push: + tags: + - 'v*' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + create-release: + runs-on: ubuntu-latest + permissions: + contents: write + id-token: write + steps: + - name: Checkout + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - name: Setup caches + uses: ./.github/actions/setup-caches + timeout-minutes: 5 + continue-on-error: true + - uses: creekorful/goreportcard-action@1f35ced8cdac2cba28c9a2f2288a16aacfd507f9 # v1.0 + - uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 + - name: Install Cosign + uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2 + - name: Run GoReleaser + uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0 + with: + version: latest + args: release --clean --timeout 90m --debug + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 00000000..df7953b0 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,42 @@ +name: Scorecards supply-chain security +permissions: {} + +on: + schedule: + - cron: '0 0 * * 5' + push: + branches: + - main + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + analysis: + runs-on: ubuntu-latest + permissions: + security-events: write + id-token: write + steps: + - name: Checkout + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + with: + persist-credentials: false + - name: Run analysis + uses: ossf/scorecard-action@483ef80eb98fb506c348f7d62e28055e49fe2398 # v2.3.0 + with: + results_file: results.sarif + results_format: sarif + repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} + publish_results: true + - name: Upload artifact + uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + - name: Upload to code-scanning + uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4 + with: + sarif_file: results.sarif \ No newline at end of file