custom_regex_scan.yml

# Edit the custom regex file and commit it to main branch to have a new customized scan
# The custom regex file can be found at:
# https://github.com/spark1security/n0s1-scheduled-scans/blob/main/.github/workflows/config/my_regex.toml
name: "Custom Regex Secret Scan"

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:

  checkout_regex_file:
    permissions: write-all
    runs-on: [ubuntu-latest]
    steps:
      - name: Checkout customized regex file
        uses: actions/checkout@v3
        with:
          ref: main
          sparse-checkout: |
            .github/workflows/config/my_regex.toml

  linear_secret_scanning:
    permissions: write-all
    runs-on: [ubuntu-latest]
    steps:
      - name: Scan Linear.app with custom regex
        uses: spark1security/n0s1-action@main
        env:
          LINEAR_TOKEN: ${{ secrets.LINEAR_TOKEN }}
        with:
          scan-target: 'linear_scan'
          report-format: "sarif"
          report-file: "report.sarif"
          regex-file: ".github/workflows/config/my_regex.toml"
      - name: Display SARIF result
        run: |
          cat jira_secret_report.sarif | jq | head -n 10
          cat jira_secret_report.sarif | jq | tail -n 50
      - name: Upload scan report to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: "report.sarif"


  jira_secret_scanning:
    permissions: write-all
    runs-on: [ ubuntu-latest ]
    steps:
      - name: Scan Jira with custom regex
        uses: spark1security/n0s1-action@main
        env:
          JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }}
        with:
          scan-target: 'jira_scan'
          user-email: 'spark1tester@gmail.com'
          platform-url: 'https://spark1us.atlassian.net'
          report-format: "sarif"
          report-file: "jira_secret_report.sarif"
          regex-file: ".github/workflows/config/my_regex.toml"
      - name: Display SARIF result
        run: |
          cat jira_secret_report.sarif | jq | head -n 10
          cat jira_secret_report.sarif | jq | tail -n 50
      - name: Upload scan report to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: "jira_secret_report.sarif"