scan.yaml

name: Scan

on:
  workflow_dispatch:
  pull_request:
    branches: [ main ]
  push:
    branches:
      - main
    paths-ignore:
      - 'README.md'
      - 'docs/**'
      - '.github/**'
      - 'LICENSE'
      - 'Taskfile.yaml'
      - '.gitignore'
      - '.gosec.config.json'
      - '.editorconfig'
      - '.goreleaser.yaml'
      - 'examples/**'

jobs:
  scan:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Code
        uses: actions/checkout@v3.5.3

      - name: Set up Go
        uses: actions/setup-go@v4.1.0
        with:
          go-version: '1.23'

      - name: Install Task
        uses: arduino/setup-task@v1.0.3
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Security Scanner
        run: task tools:install:gosec

      - name: Run Go Security Scanner
        run: task scan