chore: add SCA workflow from unified-pipeline-template #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SCA Scan | ||
| # Example: invoke the reusable sca-scan workflow from auth0/devsecops-tooling. | ||
| # Reusable workflows are called at job level via `uses:`. | ||
| # Copy this job block into your .github/workflows/ file. | ||
| # | ||
| # Required org secrets (configured at org level in auth0/): | ||
| # SNYK_TOKEN — Snyk organisation token | ||
| # SIGNAL_HANDLER_TOKEN — scan-service telemetry auth | ||
| # SIGNAL_HANDLER_DOMAIN — scan-service endpoint domain | ||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
| branches: [main] | ||
| jobs: | ||
| # ── SCA / Snyk scan via reusable workflow ─────────────────────────────────── | ||
| sca: | ||
| uses: auth0/devsecops-tooling/.github/workflows/sca-scan.yml@e29f26478db18ff0bcbe4bc447a8fbd54fbeec9e | ||
| with: | ||
| # All inputs are optional — defaults shown. Uncomment and override as needed. | ||
| # node-version: '16' | ||
| # java-version: '11' | ||
| # go-version: '1.22' | ||
| # python-version: '3.10' | ||
| # ruby-version: '4.0' | ||
| # php-version: '8.5' | ||
| # dotnet-version: '6' | ||
| # dotnet-install-dir: '/usr/share/dotnet/' | ||
| # snyk-version: 'v1.1292.0' | ||
| # additional-arguments: '' # extra Snyk CLI flags, e.g. '--severity-threshold=high' | ||
| # pre-scan-commands: '' # shell commands to run before Snyk (e.g. 'npm ci') | ||
| # runner: 'ubuntu-latest' | ||
| secrets: inherit | ||
