Merge pull request #43 from gcmurphy/workflow

Update default permissions for all workflows

Author: gcmurphy

.github/workflows/audit.yml

@@ -3,6 +3,8 @@ on:
   schedule:
     - cron: '0 0 * * *'
   workflow_dispatch:
+
+permissions: read-all
 jobs:
   audit:
     runs-on: ubuntu-latest

.github/workflows/sast.yml renamed to .github/workflows/devskim.yml

@@ -1,12 +1,14 @@
-name: Static Analysis
+name: Static Analysis - DevSkim
 on:
   push:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
   schedule:
     - cron: '30 17 * * 5'
+  workflow_dispatch:
 
+permissions: read-all
 jobs:
   lint:
     name: DevSkim
@@ -15,6 +17,7 @@ jobs:
       actions: read
       contents: read
       security-events: write
+    if: (github.action != 'dependabot[bot]')
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

.github/workflows/rust.yml

@@ -6,6 +6,8 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions: read-all
+
 env:
   CARGO_TERM_COLOR: always
 

.github/workflows/semgrep.yml

@@ -1,19 +1,38 @@
-name: Security Checks
-on: [pull_request]
+name: Static Analysis - Semgrep
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '30 17 * * 5'
+  workflow_dispatch:
+
+permissions: read-all
 jobs:
   semgrep:
     name: Static analysis (semgrep)
     continue-on-error: true
     runs-on: ubuntu-latest
     container:
       image: returntocorp/semgrep
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     if: (github.action != 'dependabot[bot]')
     steps:
-      - uses: actions/checkout@v3
-      - run: semgrep ci
+      - name: Semgrep Scan
+        uses: actions/checkout@v3
+        run: semgrep ci --sarif semgrep-results.sarif
         env:
           SEMGREP_RULES: >-
             p/security-audit
             p/secrets
             p/supply-chain
             p/rust
+
+      - name: Upload results
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: semgrep-results.sarif