Update security-gates.yml

.github/workflows/security-gates.yml

@@ -7,8 +7,22 @@ on:
   pull_request:
     branches: [ "*" ]
 jobs:
+  visibility-check:
+    outputs:
+        visibility: ${{ steps.drv.outputs.visibility }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Determine repository visibility
+        id: drv
+        run: |
+          visibility=$(gh api /repos/$GITHUB_REPOSITORY --jq '.visibility')
+          echo "visibility=$visibility" >> $GITHUB_OUTPUT
+        env:
+            GH_TOKEN: ${{ github.token }}
+
   gitleaks:
     name: gitleaks
+    needs: visibility-check
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -27,16 +41,22 @@ jobs:
 
       - name: gitleaks-scan
         run: |
+          if [ {{$needs.visibility-check.outputs.visibility}} == "public" ]; then
+          echo "public"
           ./gitleaks detect -f sarif -r gitleaks.sarif --redact --exit-code 0
+          else
+          ./gitleaks detect --redact -v --exit-code 0
+          fi
 
-      - name: gitlekas-result-upload
+      - name: gitleaks-result-upload
+        if: needs.visibility-check.outputs.visibility == 'public'
         uses: github/codeql-action/upload-sarif@v2
         with:
           sarif_file: gitleaks.sarif
-        if: always()
 
   semgrep:
     name: semgrep
+    needs: visibility-check
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -45,32 +65,50 @@ jobs:
       - name: prepare-semgrep
         run: |
            python3 -m pip install semgrep
+
       - name: semgrep-scan
         run: |
+          if [ {{$needs.visibility-check.outputs.visibility}} == "public" ]; then
           semgrep ci --config=auto --sarif --output=semgrep.sarif || true
+          echo "public"
+          ls -l
+          else
+          semgrep ci --config=auto --text || true
+          fi
 
       - name: semgrep-result-upload
+        if: needs.visibility-check.outputs.visibility == 'public'
         uses: github/codeql-action/upload-sarif@v2
         with:
           sarif_file: semgrep.sarif
-        if: always()
 
   sbom-scan:
     name: grype-sbom
+    needs: visibility-check
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
+
       - uses: anchore/scan-action@v3
         id: scan
+        if: needs.visibility-check.outputs.visibility == 'public'
         with:
           path: "."
           output-format: sarif
           fail-build: false
+
+      - uses: anchore/scan-action@v3
+        id: scan-private
+        if: needs.visibility-check.outputs.visibility == 'private'
+        with:
+          path: "."
+          output-format: table
+          fail-build: false
 
       - name: sbom-result-upload
+        if: needs.visibility-check.outputs.visibility == 'public'
         uses: github/codeql-action/upload-sarif@v2
         with:
           sarif_file: ${{ steps.scan.outputs.sarif }}
-        if: always()