mirror of
https://github.com/Kong/insomnia.git
synced 2026-09-18 19:25:25 -04:00
kwburns-kong
20b29355b3
actions/checkout steps across CI workflows leaves GITHUB_TOKEN persisted in git config after checkout. None of these steps perform a git push using that persisted credential, disable credential persistence on the actions.
33 lines
739 B
YAML
33 lines
739 B
YAML
name: SAST
|
|
|
|
on:
|
|
pull_request: {}
|
|
push:
|
|
branches:
|
|
- develop
|
|
- release/*
|
|
workflow_dispatch: {}
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
semgrep:
|
|
timeout-minutes: 5
|
|
name: Semgrep SAST
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
security-events: write
|
|
|
|
if: (github.actor != 'dependabot[bot]')
|
|
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
- uses: Kong/public-shared-actions/security-actions/semgrep@a18abf762d6e2444bcbfd20de70451ea1e3bc1b1 # 4.0.1
|