1# This workflow uses actions that are not certified by GitHub.
 2# They are provided by a third-party and are governed by
 3# separate terms of service, privacy policy, and support
 4# documentation.
 5
 6# A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities,
 7# in addition to a PR check which fails if new vulnerabilities are introduced.
 8#
 9# For more examples and options, including how to ignore specific vulnerabilities,
10# see https://google.github.io/osv-scanner/github-action/
11
12name: OSV-Scanner
13
14permissions: {}
15
16on:
17  pull_request:
18    branches: ['main']
19  merge_group:
20    branches: ['main']
21  schedule:
22    - cron: '45 6 * * 5'
23  push:
24    branches: ['main']
25
26jobs:
27  scan-scheduled:
28    if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
29    permissions:
30      security-events: write
31      contents: read
32      actions: read
33    uses: 'google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@e92b5d07338d4f0ba0981dffed17c48976ca4730' # v2.2.3
34    with:
35      # Example of specifying custom arguments
36      scan-args: |-
37        -r
38        ./
39  scan-pr:
40    if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
41    permissions:
42      security-events: write
43      contents: read
44      actions: read
45    uses: 'google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@e92b5d07338d4f0ba0981dffed17c48976ca4730' # v2.2.3
46    with:
47      # Example of specifying custom arguments
48      scan-args: |-
49        -r
50        ./