Merge pull request #49 from FlowFuse/ci-enable-sast-scan

ci: Enable SAST

Author: knolleary

.github/.trivyignore.yaml

@@ -0,0 +1,2 @@
+# Trivy ignore file
+# Add patterns to ignore specific vulnerabilities

.github/trivy.yaml

@@ -0,0 +1,29 @@
+# Trivy Security Scanner Configuration
+# Documentation: https://aquasecurity.github.io/trivy/latest/docs/configuration/
+
+scan:
+  scanners:
+    - vuln
+    - secret
+
+  skip-dirs:
+    - node_modules
+    - .git
+    - coverage
+    - ci
+
+severity:
+  - CRITICAL
+  - HIGH
+  - MEDIUM
+  - LOW
+
+pkg:
+  types:
+    - os
+    - library
+  include-dev-deps: true
+
+format: "sarif"
+ignorefile: ".github/.trivyignore.yaml"
+exit-code: 0

.github/workflows/sast-scan.yml

@@ -0,0 +1,19 @@
+name: SAST Scan
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: SAST Scan
+    uses : flowfuse/github-actions-workflows/.github/workflows/[email protected]