workflows_scans.yml

name: GitHub Actions Workflows Scans
on:
  workflow_dispatch: {}
  push:
    paths:
      - '.github/workflows/**'
    branches:
      - 'master'
      - 'releases/**'
  pull_request:
    paths:
      - '.github/workflows/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: read-all

jobs:
  codeql:
    name: github_actions_workflows_scan/codeql
    # Runner size impacts CodeQL analysis time. To learn more, please see:
    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
    #   - https://gh.io/supported-runners-and-hardware-resources
    #   - https://gh.io/using-larger-runners
    # Consider using larger runners for possible analysis time improvements.
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    permissions:
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        timeout-minutes: 15
        with:
          submodules: 'false'
          sparse-checkout: .github/workflows

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
        with:
          languages: "actions"
          build-mode: "none"

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
        with:
          category: "/language:actions"

  semgrep:
    name: github_actions_workflows_scan/semgrep
    runs-on: ubuntu-latest
    if: ${{ github.repository_owner == 'openvinotoolkit' }}

    container:
      image: semgrep/semgrep

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        timeout-minutes: 15
        with:
          submodules: 'false'
          sparse-checkout: .github/workflows

      - name: Semgrep scan
        run: |
          semgrep scan --error -j 8 --config "p/github-actions" .github/workflows/*