sobelow.yml

name: Sobelow

on:
  push:
    branches: ["main"]
    paths:
      - "server/**"
  pull_request:
    branches: ["main"]
    paths:
      - "server/**"
  schedule:
    - cron: "18 11 * * 0"

permissions:
  contents: read

jobs:
  security-scan:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2

      - name: Install deps
        run: |
          sudo apt-get update
          sudo apt-get install -y elixir
          mix local.hex --force
          mix escript.install hex sobelow --force

      - name: Run Sobelow and Generate SARIF
        run: |
          cd server
          ~/.mix/escripts/sobelow --format sarif --out ../results.sarif
        env:
          MIX_HOME: ${{ runner.temp }}/mix

      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif