name: scan

on:
  pull_request:

permissions:
  id-token: write # write jwt token
  actions: read # read gh actions
  contents: read # read access to the repo

jobs:
  scan:
    name: scan
    runs-on: ubuntu-latest
    steps:
      - name: checkout code
        uses: actions/checkout@v4
      - name: run puma scan
        uses: pumasecurity/puma-scan-pro-action@v1
        env:
          PUMA_LICENSE: ${{ secrets.PUMA_LICENSE }}
        with:
          project-paths: "./Web/Web.csproj"
          output-formats: "json,html,sarif,msbuild"
          output-file: "./results/puma-scan"
          settings-paths: "./.pumafile"