security.yml

name: Security Scan

on:
  push:
    branches:
      - master

jobs:
  security_scan:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.2.0

      - name: Install dependencies
        run: |
          gem install bundler
          bundle install

      - name: Run Bundler Audit
        run: |
          bundle audit check --update

      - name: Run Brakeman
        run: |
          gem install brakeman
          brakeman

      - name: Depcheck
        uses: dependency-check/Dependency-Check_Action@main
        id: Depcheck
        with:
          project: 'test'
          path: '.'
          format: 'HTML'
          out: 'reports' # this is the default, no need to specify unless you wish to override it
          args: >
            --failOnCVSS 7
            --enableRetired

      - name: Upload Test results
        uses: actions/upload-artifact@master
        with:
          name: Depcheck report
          path: ${{github.workspace}}/reports