brakeman.yml

---
# ------------------------------------------------------------------------------
# This workflow integrates Brakeman with GitHub's Code Scanning feature
# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications
#
name: Brakeman Scan

on:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  brakeman-scan:
    name: Brakeman Scan
    runs-on: ubuntu-latest

    permissions:
      contents: read
      # for github/codeql-action/upload-sarif to upload SARIF results
      security-events: write

    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.3.4
          bundler-cache: true
      -
        name: Setup Brakeman
        run: gem install brakeman
      -
        name: Scan
        continue-on-error: true
        run: brakeman -f sarif -o output.sarif.json .
      -
        name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: output.sarif.json