Change workflow to checkout config as well. #3

	name: Scan GitHub Action workflows files for security issues

	on:
	pull_request: {}
	workflow_dispatch: {}
	push:
	paths:
	- '.github/workflows/**.ya?ml'

	permissions:
	contents: read
	security-events: write

	jobs:
	semgrep:
	name: semgrep-oss/scan
	runs-on: ubuntu-latest

	container:
	image: semgrep/semgrep

	# Skip any PR created by dependabot to avoid permission issues:
	if: (github.actor != 'dependabot[bot]')

	steps:
	- name: Checkout Workflow Config
	uses: actions/checkout@v4
	env:
	GH_ACTION_REPOSITORY: ${{ github.action_repository }}
	GH_ACTION_REF: ${{ github.action_ref }}
	with:
	repository: '${{ env.GH_ACTION_REPOSITORY }}'
	ref: '${{ env.GH_ACTION_REF }}'
	path: action_scanning

	- name: Checkout Code
	uses: actions/checkout@v4
	with:
	path: code_to_scan

	- name: Run Actions semgrep scan
	run: semgrep scan --sarif --config action_scanning/semgrep-rules/actions code_to_scan >> semgrep-results-actions.sarif

	- name: Save Actions SARIF results as artifact
	uses: actions/upload-artifact@v4
	with:
	name: semgrep-scan-results-actions
	path: semgrep-results-actions.sarif

	- name: Upload Actions SARIF result to the GitHub Security Dashboard
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: semgrep-results-actions.sarif
	if: always()

Provide feedback