scan.yml

---
name: Code Scanning

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  scan:
    name: scan
    runs-on: ubuntu-latest

    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Install dependencies
        run: |
          sudo apt-get install -qq shellcheck
          sudo curl -sSL -o /usr/local/bin/shellcheck-sarif \
            https://github.com/psastras/sarif-rs/releases/download/shellcheck-sarif-latest/shellcheck-sarif-x86_64-unknown-linux-gnu 
          sudo chmod +x /usr/local/bin/shellcheck-sarif

      - name: Run Shellcheck
        run: |
          shellcheck -f json gh-repo-stats | shellcheck-sarif > results.sarif

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: results.sarif