pr-security-scan.yml

# Copyright Advanced Micro Devices, Inc.
# SPDX-License-Identifier: MIT
#
# Pre-commit security gate: fast, PR-side security scanners that run on
# every pull request. The security counterpart to `pre-commit.yml`. The
# set of scanners lives in `security-baseline.yml`, so scanners coming
# online are picked up here without touching this file.
#
# Requests human-readable reports only: findings are uploaded as a build
# artifact and printed to the job summary, never to the Security tab, so
# fork PRs (which never receive elevated tokens) behave identically to
# same-repo PRs. See the scheduled counterpart (weekly-security-scan.yml)
# for the SARIF / code-scanning upload.

name: Security scan (PR)

on:
  pull_request:
    # Spelled out the default to avoid confusion.
    types: [opened, synchronize, reopened]

permissions:
  contents: read

# A newer commit on a pull request cancels the run for the older one.
# Every other run gets a group of its own: in a shared group, a newer run
# replaces a pending one even without cancel-in-progress, which would
# leave a commit unscanned.
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
  cancel-in-progress: true

jobs:
  security:
    name: Security scan
    uses: ROCm/rocm-security-gh/.github/workflows/security-baseline.yml@32809e0da73e06ecf1f42f86cce258474d3a287a # v1.0.4
    with:
      report_formats: human
      bandit_config_path: .github/scan_tools_configs/bandit.yml
      gitleaks_config_path: .github/scan_tools_configs/gitleaks.toml
      trivy_config_path: .github/scan_tools_configs/trivy.yml
      zizmor_config_path: .github/scan_tools_configs/zizmor.yml