gosec.yml

name: Gosec
on:
  push:
    tags:
      - '*'
  pull_request:

env: 
  GOPRIVATE: github.com/zeta-chain/*
  
jobs:
  gosec:
    runs-on: ubuntu-latest

    env:
      GO111MODULE: on
    steps:
      - name: Checkout Source
        uses: actions/checkout@v2
        with:
          fetch-depth: 0 

      - name: setup-git-credentials
        uses: de-vri-es/setup-git-credentials@v2.0.8
        with:
          credentials: ${{ secrets.PAT_GITHUB_SERVICE_ACCT }}


      - name: Set up Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.18

      # - name: Install Pipeline Dependencies
      #   uses:  ./.github/actions/install-dependencies

      - name: Run Gosec Security Scanner
        run: |
          export PATH=$PATH:$(go env GOPATH)/bin
          go install github.com/securego/gosec/v2/cmd/gosec@latest
          gosec ./...

  git-guardian:
    runs-on: ubuntu-latest

    env:
      GO111MODULE: on
    steps:
      - name: Checkout Source
        uses: actions/checkout@v2
        with:
          fetch-depth: 0 

      - name: GitGuardian scan
        uses: GitGuardian/ggshield-action@master
        env:
          GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
          GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
          GITHUB_PULL_BASE_SHA:  ${{ github.event.pull_request.base.sha }}
          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}