devskim.yml

name: 'MSFT Dev Skim'

on:
  workflow_dispatch:
  pull_request:
    branches:
      - 'main'

permissions:
  # required for all workflows
  security-events: write
  # only required for workflows in private repositories
  actions: read
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-24.04
    steps:
    - name: 'Harden Runner'
      uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
      with:
        egress-policy: audit

    - name: 'Checkout'
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
    - uses: microsoft/DevSkim-Action@4b5047945a44163b94642a1cecc0d93a3f428cc6 #v1.0.16
    - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba  #v4.32.3 # v4.35.5
      with:
        sarif_file: devskim-results.sarif