feat(docs, aws reporters): Lots of doc updates, also added BedrockSum… #67
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #checkov:skip=CKV2_GHA_1:The permissions are not set to write-all at the top-level, or any level | |
| name: Run ASH | |
| on: | |
| pull_request: | |
| branches: | |
| - "*" | |
| workflow_dispatch: {} | |
| env: | |
| PYTHON_VERSION: "3.12" | |
| jobs: | |
| ash: | |
| # uses: awslabs/automated-security-helper/.github/workflows/run-ash-security-scan.yml@v3.0.0-beta-20250526151056 | |
| uses: ./.github/workflows/run-ash-security-scan.yml | |
| permissions: | |
| #checkov:skip=CKV2_GHA_1:The permissions are not set to write-all at the top-level, or any level | |
| contents: read # Required to read the repository contents in order to scan them with ASH | |
| checks: write # Required for writing CI check runs | |
| pull-requests: write # Required for writing comments with scan results to pull requests | |
| security-events: write # Required for collection of SARIF code scanning results for GitHub Advanced Security checks | |
| with: | |
| ash-version: ${{ github.head_ref || github.ref_name }} | |
| repository-owner: ${{ github.repository_owner }} | |
| ash-args: '--inspect' | |
| fail-on-findings: false | |
| collect-junit-xml-report: true | |
| collect-sarif-report: true | |
| post-pr-comment: true | |
| verbose: true | |
| python-version: '3.12' | |
| ash-mode: container | |
| output-dir: '.ash/ash_output' | |
| config: '.ash/.ash.yaml' |