Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| # You can pin the exact commit or the version. | ||
| uses: SonarSource/sonarqube-scan-action@v1.1.0 | ||
| #uses: SonarSource/sonarqube-scan-action@7295e71c9583053f5bf40e9d4068a0c974603ec8 |
Check failure
Code scanning / Semgrep
Semgrep Finding: generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key
|
|
||
| # Initializes the CodeQL tools for scanning. | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v2 |
Check warning
Code scanning / Semgrep
Semgrep Finding: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
| # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift). | ||
| # If this step fails, then you should remove it and run the build manually (see below) | ||
| - name: Autobuild | ||
| uses: github/codeql-action/autobuild@v2 |
Check warning
Code scanning / Semgrep
Semgrep Finding: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
| # ./location_of_script_within_repo/buildscript.sh | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v2 |
Check warning
Code scanning / Semgrep
Semgrep Finding: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
| - name: Analyze with SonarQube | ||
|
|
||
| # You can pin the exact commit or the version. | ||
| uses: SonarSource/sonarqube-scan-action@v1.1.0 |
Check warning
Code scanning / Semgrep
Semgrep Finding: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
|
|
||
| # step 4 | ||
| - name: Publish Code Scanning Alerts | ||
| uses: github/codeql-action/upload-sarif@v2 |
Check warning
Code scanning / Semgrep
Semgrep Finding: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
1 participant
No description provided.