From deae0fbba8caaae2330df2e7c02cb0ea1b898b78 Mon Sep 17 00:00:00 2001 From: marcellawigg-qz Date: Wed, 11 Jun 2025 11:36:17 -0600 Subject: [PATCH] [SECOPS-838] Add Psalm to fully test GHAS PHP capability. CodeQL does not allow PHP scanning unlike Snyk, so we are trying Psalm, a third-party tool to see if it provides any results. --- .github/workflows/psalm.yml | 38 +++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/psalm.yml diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml new file mode 100644 index 0000000..0cd4582 --- /dev/null +++ b/.github/workflows/psalm.yml @@ -0,0 +1,38 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Psalm Security Scan + +on: + push: + branches: [ "master" ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ "master" ] + schedule: + - cron: '40 10 * * 1' + +permissions: + contents: read + +jobs: + php-security: + runs-on: ubuntu-latest + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Psalm Security Scan + uses: psalm/psalm-github-security-scan@f3e6fd9432bc3e44aec078572677ce9d2ef9c287 + + - name: Upload Security Analysis results to GitHub + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif