guarddog.yml

name: "Guarddog"

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

permissions:
  contents: read

jobs:
  guarddog:
    permissions:
      contents: read
      security-events: write
  name: Scan dependencies
  runs-on: ubuntu-latest

  steps:

    - name: Checkout
      uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: "3.10"

    - name: Install GuardDog
      run: pip install guarddog

    - name: Scan common requirements
      run: guarddog pypi verify requirements.txt --output-format sarif > guarddog_common.sarif

    - name: Scan dev requirements
      run: guarddog pypi verify requirements-dev.txt --output-format sarif > guarddog_dev.sarif

    - name: Upload SARIF file to GitHub
      uses: github/codeql-action/upload-sarif@v3
      with:
        category: guarddog-builtin
        sarif_file: [ 'guarddog_common.sarif', 'guarddog_dev.sarif' ]