Merge pull request #912 from gfs/main

Adds an example for using the DevSkim code scanning action

code-scanning/devskim.yml

@@ -0,0 +1,34 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: DevSkim
+
+on:
+  push:
+    branches: [ $default-branch, $protected-branches ]
+  pull_request:
+    branches: [ $default-branch ]
+  schedule:
+    - cron: $cron-weekly
+
+jobs:
+  lint:
+    name: DevSkim
+    runs-on: ubuntu-20.04
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Run DevSkim scanner
+        uses: microsoft/DevSkim-Action@v1
+        
+      - name: Upload DevSkim scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: devskim-results.sarif

code-scanning/properties/devskim.properties.json

@@ -0,0 +1,7 @@
+{
+    "name": "DevSkim",
+    "creator": "Microsoft CST-E",
+    "description": "DevSkim is security linter that highlights common security issues in source code.",
+    "iconName": "cst-logo",
+    "categories": ["Code Scanning", "C", "C#", "C++", "Go", "Java", "JavaScript", "TypeScript", "Python", "Powershell", "Cobol", "Objective C", "PHP", "Ruby", "Rust", "SQL", "Swift", "Visual Basic"]
+}

icons/cst-logo.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="480" height="480" viewBox="0 0 480 480" xml:space="preserve">
+<g transform="matrix(1.27 0 0 1.27 240.37 240.13)"  >
+<path style="stroke: none; stroke-width: 0; stroke-dasharray: none; stroke-linecap: butt; stroke-dashoffset: 0; stroke-linejoin: miter; stroke-miterlimit: 4; fill: rgb(0,166,81); fill-rule: evenodd; opacity: 1;" vector-effect="non-scaling-stroke"  transform=" translate(-254.79, -255.14)" d="M 385 126 q 3 29.5 6 59 c 14.887 99.029 -26.989 173.188 -76 210 c -15.011 11.275 -34.444 28.678 -55 33 c -23.295 4.9 -62.125 -29.538 -74 -40 c -47.1 -41.491 -81.871 -110.908 -67 -207 q 2.5 -27.5 5 -55 c 56.2 0 79.764 -31.923 122 -43 c 21.768 -5.709 39.243 10.642 51 17 C 321.744 113.382 347.824 125.771 385 126 Z M 257 146 l 10 20 l -10 16 v 1 c 54.64 4.6 54.618 49.256 64 95 l 23 2 C 366.547 210.191 324.832 147.532 257 146 Z m -20 1 c -13.088 6.944 -27.628 8 -39 16 c -23.257 16.355 -58.678 71.48 -34 114 l 14 -13 l 2 -3 l 18 5 v -4 c -12.586 -32.148 9.054 -62.976 29 -73 l 17 -5 q 6 -9 12 -18 l -10 -19 h -9 Z M 183 271 c -4.776 6.187 -12.116 10.084 -14 19 c 15.62 18.551 27.581 36.088 53 45 c 43.771 15.347 110.459 -10.4 116 -46 l -23 -1 l -7 -17 l -2 1 c -3.756 9.36 -10.955 14.8 -19 20 C 243.212 320.315 218.111 283.968 183 271 Z" stroke-linecap="round" />
+</g>
+</svg>