scan.yaml

name: Scan

on:
  workflow_dispatch:
  pull_request:
    branches: [ main ]
  push:
    branches:
      - main
    paths-ignore:
      - 'README.md'
      - 'docs/**'
      - 'chart/**'
      - 'charts/**'
      - 'scripts/**'
      - 'gen/openapi/**'
      - '.github/**'
      - 'LICENSE'
      - '.taskfiles/**'
      - 'Taskfile.yaml'
      - '.gitignore'
      - '.gosec.config.json'
      - '.editorconfig'
      - '.goreleaser.yaml'
      - 'examples/**'
      - '*.http'
      - 'web/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0

      - name: Set up Go
        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
        with:
          go-version: '1.22'

      - name: Install Task
        uses: arduino/setup-task@v1.0.3
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Security Scanner
        run: task tools:install:gosec

      - name: Run Go Security Scanner
        run: task scan