security-checks.yml

name: Security Checks
on:
  push:
  schedule:
    - cron: '0 5 * * *'

jobs:
  bearer:
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v3
        - uses: ruby/setup-ruby@v1
          with:
            bundler-cache: true
        - name: install bearer
          run: |
            sudo apt-get install apt-transport-https
            echo "deb [trusted=yes] https://apt.fury.io/bearer/ /" | sudo tee -a /etc/apt/sources.list.d/fury.list
            sudo apt-get update
            sudo apt-get install bearer
        - name: run bearer
          run: |
            bearer scan --quiet --config-file ./bearer.yml .
        - name: build bearer report
          if: failure()
          run: |
            bearer scan --quiet --config-file ./bearer.yml --format html --output bearer.html .
        - name: upload bearer failure report
          uses: actions/upload-artifact@v4
          if: failure()
          with:
            name: Security Reports
            path: bearer.html
  brakeman:
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v3
        - uses: artplan1/brakeman-action@v1.2.1
          with:
            flags: "--color"

        # - uses: ruby/setup-ruby@v1
        #   with:
        #     bundler-cache: true
        # - name: install brakeman
        #   run: |
        #     gem install brakeman
        # - name: run brakeman
        #   run: |
        #     brakeman --format html --output brakeman.html
        # - name: upload brakeman failure report
        #   uses: actions/upload-artifact@v3
        #   if: failure()
        #   with:
        #     name: Security Reports
        #     path: brakeman.html
  bundler-audit:
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v3
        - uses: ruby/setup-ruby@v1
          with:
            bundler-cache: true
        - name: install bundler-audit
          run: |
            gem install bundler-audit && bundle-audit update
        - name: run bundler-audit
          run: |
            bundle-audit --output=bundler_audit.txt
        - name: upload bundler-audit failure report
          uses: actions/upload-artifact@v3
          if: failure()
          with:
            name: Security Reports
            path: bundler_audit.txt