chocolatey
(GH-570) Add GitHub Action scanning workflows
Description Of Changes
Add GitHub Action workflows that run security and static analysis
- Add PSScriptAnalyzer workflow
- Add Codacy workflow
- Add DevSkim workflow
- Add CodeQL workflow
Motivation and Context
Strengthen security checking and reduce risk of introducing vulnerabilities
Testing
Tested in my repo
Change Types Made
- [ ] Bug fix (non-breaking change).
- [x] Feature / Enhancement (non-breaking change).
- [ ] Breaking change (fix or feature that could cause existing functionality to change).
- [ ] Documentation changes.
- [ ] PowerShell code changes.
Change Checklist
- [ ] Requires a change to the documentation.
- [ ] Documentation has been updated.
- [ ] Tests to cover my changes, have been added.
- [ ] All new and existing tests passed?
- [ ] PowerShell code changes: PowerShell v3 compatibility checked?
Related Issue
Fixes #570
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.
![github-advanced-security[bot] avatar](https://avatars.githubusercontent.com/in/57789?v=4 "Published by a pub.dev verified publisher"){kind=small}
This looks awesome! .. I just wonder if we should work on some of the issues or we can/should add some exceptions for the hits.
Probably need to review them and figure out which ones are actionable and which ones may not be relevant.
They were just the default values created by the GitHub templates, but yeah that sounds like a better idea
But unfortunately GitHub Actions don't support that - https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#schedule
I will tweak the schedules though