# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: clj-holmes

on:
  push:
    branches: [ $default-branch, $protected-branches ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ $default-branch ]
  schedule:
    - cron: $cron-weekly

permissions:
  contents: read

jobs:
  clj-holmes:
    name: Run clj-holmes scanning
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Scan code
        uses: clj-holmes/clj-holmes-action@200d2d03900917d7eb3c24fc691ab83579a87fcb
        with:
          # rules-repository: 'git://org/private-rules-repo#main'
          output-type: 'sarif'
          output-file: 'clj-holmes-results.sarif'
          fail-on-result: 'false'

      - name: Upload analysis results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{github.workspace}}/clj-holmes-results.sarif
          wait-for-processing: true