code-quality-scan.yml

name: Code Quality Scan

on:
  workflow_dispatch:
  schedule:
    - cron: '0 6 * * 1'

permissions:
  security-events: write
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        app: ['001', '002', '003', '004', '005']
      fail-fast: false
    steps:
      - uses: actions/checkout@v4
        with:
          repository: devopsabcs-engineering/cq-demo-app-${{ matrix.app }}

      - name: Run MegaLinter
        uses: oxsecurity/megalinter@v8
        continue-on-error: true
        env:
          VALIDATE_ALL_CODEBASE: true
          SARIF_REPORTER: true

      - name: Upload SARIF artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: megalinter-sarif-${{ matrix.app }}
          path: megalinter-reports/megalinter-report.sarif

      - name: Upload SARIF to target repo
        if: always() && hashFiles('megalinter-reports/megalinter-report.sarif') != ''
        env:
          GH_TOKEN: ${{ secrets.ORG_ADMIN_TOKEN }}
        run: |
          gzip -c megalinter-reports/megalinter-report.sarif | base64 -w0 > /tmp/sarif_encoded.txt
          COMMIT_SHA=$(gh api repos/devopsabcs-engineering/cq-demo-app-${{ matrix.app }}/commits/main --jq '.sha')
          jq -n --arg sha "$COMMIT_SHA" --arg ref "refs/heads/main" --rawfile sarif /tmp/sarif_encoded.txt \
            '{commit_sha: $sha, ref: $ref, sarif: $sarif}' | \
          gh api --method POST \
            repos/devopsabcs-engineering/cq-demo-app-${{ matrix.app }}/code-scanning/sarifs \
            --input -
          echo "Uploaded MegaLinter SARIF to cq-demo-app-${{ matrix.app }}"