Commit `1c06f3aec4`

1c06f3aec40ad4c5707e5730e5ec660d29d38468

Unsigned

cmc <hello@cleberg.net> · 2024-11-07 02:02 UTC

add pysa

Layout: unified · split

.github/workflows/pysa.yml added +50

		@@ -0,0 +1,50 @@
	1	# This workflow uses actions that are not certified by GitHub.
	2	# They are provided by a third-party and are governed by
	3	# separate terms of service, privacy policy, and support
	4	# documentation.
	5
	6	# This workflow integrates Python Static Analyzer (Pysa) with
	7	# GitHub's Code Scanning feature.
	8	#
	9	# Python Static Analyzer (Pysa) is a security-focused static
	10	# analysis tool that tracks flows of data from where they
	11	# originate to where they terminate in a dangerous location.
	12	#
	13	# See https://pyre-check.org/docs/pysa-basics/
	14
	15	name: Pysa
	16
	17	on:
	18	workflow_dispatch:
	19	push:
	20	branches: [ $default-branch, $protected-branches ]
	21	pull_request:
	22	branches: [ $default-branch ]
	23	schedule:
	24	- cron: $cron-weekly
	25
	26	permissions:
	27	contents: read
	28
	29	jobs:
	30	pysa:
	31	permissions:
	32	actions: read
	33	contents: read
	34	security-events: write
	35
	36	runs-on: ubuntu-latest
	37	steps:
	38	- uses: actions/checkout@v4
	39	with:
	40	submodules: true
	41
	42	- name: Run Pysa
	43	uses: facebook/pysa-action@f46a63777e59268613bd6e2ff4e29f144ca9e88b
	44	with:
	45	# To customize these inputs:
	46	# See https://github.com/facebook/pysa-action#inputs
	47	repo-directory: './'
	48	requirements-path: 'requirements.txt'
	49	infer-types: true
	50	include-default-sapp-filters: true

Commit 1c06f3aec4