endorlabs.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: Endor Labs
on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    - cron: '39 0 * * 4'
permissions:
  contents: read

jobs:
  scan:
    permissions:
      security-events: write # Used to upload sarif artifact to GitHub
      contents: read # Used to checkout a private repository by actions/checkout.
      actions: read # Required for private repositories to upload sarif files. GitHub Advanced Security licenses are required.
      id-token: write # Used for keyless authentication to Endor Labs
    runs-on: windows-latest
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
      with:
        egress-policy: audit

    - name: Checkout repository
      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
    #### Package Build Instructions
    ### Use this section to define the build steps used by your software package.
    ### Endor Labs builds your software for you where possible but the required build tools must be made available.
    # - name: Setup Java
    #   uses: actions/setup-java@v3
    #   with:
    #     distribution: 'microsoft'
    #     java-version: '17'
    # - name: Build Package
    #   run: mvn clean install
    - name: Endor Labs scan pull request
      if: github.event_name == 'pull_request'
      uses: endorlabs/github-action@a8ac7b44747fcbe98d0e80ab2d4e91f7ab9028fa
      with:
        namespace: "example" # Modify the namespace to your Endor Labs tenant namespace.
        sarif_file: findings.sarif
    - name: Endor Labs scan monitor
      if: github.event_name == 'push'
      uses: endorlabs/github-action@a8ac7b44747fcbe98d0e80ab2d4e91f7ab9028fa
      with:
        namespace: "example" # Modify the namespace to your Endor Labs tenant namespace.
        ci_run: "false"
        sarif_file: findings.sarif
    - name: Upload SARIF to github
      uses: github/codeql-action/upload-sarif@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff
      with:
        sarif_file: findings.sarif