security-code-scanner.yml

name: MetaMask Security Code Scanner

on:
  workflow_call:
    secrets:
      SECURITY_SCAN_METRICS_TOKEN:
        required: false
      APPSEC_BOT_SLACK_WEBHOOK:
        required: false
  workflow_dispatch:

jobs:
  run-security-scan:
    name: Run security scan
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Analyse code
        uses: MetaMask/action-security-code-scanner@v1
        with:
          repo: ${{ github.repository }}
          paths_ignored: |
            '**/jest.config.js'
            '**/jest.environment.js'
            '**/mocks/'
            '**/test/'
            'node_modules'
            'packages/delegator-e2e'
          rules_excluded: example
          project_metrics_token: ${{ secrets.SECURITY_SCAN_METRICS_TOKEN }}
          slack_webhook: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}