# This workflow integrates Brakeman with GitHub's Code Scanning feature
# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications

name: Brakeman Scan

on:
  push:
    branches: [ master, chef-server-13 ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ master ]
  schedule:
    - cron: '22 13 * * 3'

jobs:
  brakeman-scan:
    name: Brakeman Scan
    runs-on: ubuntu-latest
    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v2

    # Customize the ruby version depending on your needs
    - name: Setup Ruby
      uses: actions/setup-ruby@v1
      with:
        ruby-version: '2.6'

    - name: Setup Brakeman
      env:
        BRAKEMAN_VERSION: '4.10' # SARIF support is provided in Brakeman version 4.10+
      run: |
        gem install brakeman --version $BRAKEMAN_VERSION

    # Execute Brakeman CLI and generate a SARIF output with the security issues identified during the analysis
    - name: Scan
      continue-on-error: true
      run: |
        brakeman -f sarif -o output.sarif.json src/oc-id

    # Upload the SARIF file generated in the previous step
    - name: Upload SARIF
      uses: github/codeql-action/upload-sarif@v1
      with:
        sarif_file: output.sarif.json

# This workflow integrates Brakeman with GitHub's Code Scanning feature
# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications

name: Brakeman Scan

on:
  push:
    branches: [ master, chef-server-13 ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ master ]
  schedule:
    - cron: '22 13 * * 3'

jobs:
  brakeman-scan:
    name: Brakeman Scan
    runs-on: ubuntu-latest
    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v2

    # Customize the ruby version depending on your needs
    - name: Setup Ruby
      uses: actions/setup-ruby@v1
      with:
        ruby-version: '2.6'

    - name: Setup Brakeman
      env:
        BRAKEMAN_VERSION: '4.10' # SARIF support is provided in Brakeman version 4.10+
      run: |
        gem install brakeman --version $BRAKEMAN_VERSION

    # Execute Brakeman CLI and generate a SARIF output with the security issues identified during the analysis
    - name: Scan
      continue-on-error: true
      run: |
        brakeman -f sarif -o output.sarif.json src/oc-id --skip-files habitat/

    # Upload the SARIF file generated in the previous step
    - name: Upload SARIF
      uses: github/codeql-action/upload-sarif@v1
      with:
        sarif_file: output.sarif.json

Exclude the habitat directory in the brakeman scans
Exclude the habitat directory in the brakeman scans

This dir has files that can't be parsed correctly and don't matter to
rails static analysis.

Signed-off-by: Tim Smith <764ef62106582a09ed09dfa0b6bff7c05fd7d1e4@chef.io>
