Run code scanner from main workflow (#3073)

This updates the code scanner workflow to run from the main workflow, instead of a separate workflow.
MetaMask · Feb 6, 2025 · cc5cc01 · cc5cc01
1 parent eebe356
commit cc5cc01
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 5 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -20,6 +20,18 @@ jobs:
         run: ${{ steps.download-actionlint.outputs.executable }} -color
         shell: bash
 
+  analyse-code:
+    name: Code scanner
+    needs: check-workflows
+    uses: ./.github/workflows/security-code-scanner.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    secrets:
+      SECURITY_SCAN_METRICS_TOKEN: ${{ secrets.SECURITY_SCAN_METRICS_TOKEN }}
+      APPSEC_BOT_SLACK_WEBHOOK: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}
+
   update-pull-request:
     name: Update pull request
     needs: check-workflows

diff --git a/.github/workflows/security-code-scanner.yml b/.github/workflows/security-code-scanner.yml
@@ -1,19 +1,23 @@
 name: 'MetaMask Security Code Scanner'
 
 on:
-  push:
-    branches: ['main']
-  pull_request:
+  workflow_call:
+    secrets:
+      SECURITY_SCAN_METRICS_TOKEN:
+        required: false
+      APPSEC_BOT_SLACK_WEBHOOK:
+        required: false
 
 jobs:
   run-security-scan:
+    name: Run security scan
     runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
       security-events: write
     steps:
-      - name: MetaMask Security Code Scanner
+      - name: Analyse code
         uses: MetaMask/Security-Code-Scanner@main
         with:
           repo: ${{ github.repository }}
@@ -31,5 +35,5 @@ jobs:
             '**/jest.environment.js'
             '**/jest.config.js'
             node_modules
-          project_metrics_token: ${{secrets.SECURITY_SCAN_METRICS_TOKEN}}
+          project_metrics_token: ${{ secrets.SECURITY_SCAN_METRICS_TOKEN }}
           slack_webhook: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}