diff --git a/.github/workflows/check-dependencies.yml b/.github/workflows/check-dependencies.yml new file mode 100644 index 000000000..17caf3aa6 --- /dev/null +++ b/.github/workflows/check-dependencies.yml @@ -0,0 +1,19 @@ +name: Check dependencies + +# Adapted from https://google.github.io/osv-scanner/github-action/#scan-on-pull-request + +on: + pull_request: + branches: [main, 1.*.x] + merge_group: + branches: [main, 1.*.x] + +permissions: + # Require writing security events to upload SARIF file to security tab + security-events: write + # Only need to read contents + contents: read + +jobs: + scan-pr: + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v1.7.1" \ No newline at end of file diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml deleted file mode 100644 index e4ee26c79..000000000 --- a/.github/workflows/osv-scanner.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: OSV Scanner - -on: - pull_request: - push: - -jobs: - OSV-Scanner: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - with: - fetch-depth: 0 - - - name: Install Golang - uses: actions/setup-go@v4 - with: - go-version: '1.19' - - - name: Install OSV Scanner - run: | - go install github.com/google/osv-scanner/cmd/osv-scanner@latest - - - name: Scan for Vulnerabilities - run: | - osv-scanner -r .