security.yml

---
name: Security

on: # yamllint disable-line rule:truthy
  pull_request: {}
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      security-type:
        description: What Security scanning you would like to run?
        required: false
        default: "all"
        type: choice
        options: ["all", "sca", "code-scanning"]

jobs:
  sast:
    name: SAST
    uses: fabasoad/reusable-workflows/.github/workflows/wf-security-sast.yml@main
    permissions:
      contents: read
      security-events: write
    with:
      code-scanning: ${{ contains(fromJSON('["all", "code-scanning"]'), github.event.inputs.security-type || 'all') }}
      sca: ${{ contains(fromJSON('["all", "sca"]'), github.event.inputs.security-type || 'all') }}