#-----------------------------------------------------------------------------
#
#  TSDuck - The MPEG Transport Stream Toolkit
#  Copyright (c) 2005-2023, Thierry Lelegard
#  BSD-2-Clause license, see LICENSE.txt file or https://tsduck.io/license
#
#  GitHub Actions configuration file : flawfinder security analysis
#
#-----------------------------------------------------------------------------

name: FlawFinder security analysis

# This workflow is currently disabled, except manual trigger (workflow_dispatch),
# because it generates too many false positives. FlawFinder is very awkward.
# For instance, every call to a method named open() results in an error ("Check
# when opening files - can an attacker redirect it (via symlinks), etc...")
# Even though this open() method has nothing to do with files. And there are
# many examples like this.

on:
  workflow_dispatch:
  # push:
  #   branches: ['master', 'main']
  # pull_request:
  #   branches: ['master', 'main']

jobs:
  flawfinder:
    name: Flawfinder
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: flawfinder_scan
        uses: david-a-wheeler/flawfinder@8e4a779ad59dbfaee5da586aa9210853b701959c
        with:
          arguments: '--sarif ./'
          output: 'flawfinder_results.sarif'

      - name: Upload analysis results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: ${{github.workspace}}/flawfinder_results.sarif
