security.yml

# Copyright 2024 - GitHub user: fredericks1982

# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at

#     http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Security checks

on:
  push:
    branches: [master,update-version]
    paths-ignore:
      - '**.rst'
      - '**.md'
      - 'docs/**'
      - '.github/**'
  pull_request:
    branches: [master,update-version]
    paths-ignore:
      - '**.rst'
      - '**.md'
      - 'docs/**'
      - '.github/**'
  schedule:
    # Twice per month (7th and 22nd) at 5:45 AM UTC
    - cron: '45 5 7 * *'
    - cron: '45 5 22 * *'
  workflow_dispatch:

jobs:
  security:
    runs-on: ubuntu-latest

    steps:
    - name: Check out repository
      uses: actions/checkout@v4
      with:
        fetch-depth: 0 # fetch all history so multiple commits can be scanned

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.12'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install bandit

    - name: Run Bandit
      run: bandit -r ./aiocamedomotic

    - name: GitGuardian scan
      uses: GitGuardian/ggshield-action@v1.29.0
      env:
        GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
        GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
        GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}