diff --git a/code-scanning/powershell.yml b/code-scanning/powershell.yml new file mode 100644 index 0000000..dfbf452 --- /dev/null +++ b/code-scanning/powershell.yml @@ -0,0 +1,42 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# +# https://github.com/microsoft/action-psscriptanalyzer +# For more information on PSScriptAnalyzer in general, see +# https://github.com/PowerShell/PSScriptAnalyzer + +name: PSScriptAnalyzer + +on: + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + branches: [ $default-branch ] + schedule: + - cron: $cron-weekly + +jobs: + build: + name: PSScriptAnalyzer + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + + - name: Run PSScriptAnalyzer + uses: microsoft/psscriptanalyzer-action@2044ae068e37d0161fa2127de04c19633882f061 + with: + # Check https://github.com/microsoft/action-psscriptanalyzer for more info about the options. + # The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules. + path: .\ + recurse: true + # Include your own basic security rules. Removing this option will run all the rules + includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"' + output: results.sarif + + # Upload the SARIF file generated in the previous step + - name: Upload SARIF results file + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: results.sarif diff --git a/code-scanning/properties/powershell.properties.json b/code-scanning/properties/powershell.properties.json new file mode 100644 index 0000000..95420ae --- /dev/null +++ b/code-scanning/properties/powershell.properties.json @@ -0,0 +1,7 @@ +{ + "name": "PSScriptAnalyzer", + "creator": "Microsoft Corporation", + "description": "A static code checker for PowerShell modules and scripts. PSScriptAnalyzer checks the quality of PowerShell code by running a set of rules.", + "iconName": "powershell", + "categories": ["Code Scanning", "PowerShell"] +} \ No newline at end of file diff --git a/icons/powershell.svg b/icons/powershell.svg new file mode 100644 index 0000000..ec01c8c --- /dev/null +++ b/icons/powershell.svg @@ -0,0 +1,29 @@ + + + + + + + + + + + \ No newline at end of file