mcode-action/workflow.yml at main · ForAllSecure/mcode-action · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
# This workflow starts your API and fuzzes it with ForAllSecure Mayhem for API
# to find reliability, performance and security issues before they reach
# production.
#
# To use this workflow, you will need to:
#
# 1. Create a Mayhem for Code account at
#    https://mayhem.forallsecure.com/ (free trial)
#
# 2. Update the "Build your target" step to build your target
#
# If you have any questions, please contact us at support@forallsecure.com

name: "Mayhem for Code"
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  mayhem-for-code:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Build your target so that mayhem is ready to run them
      - name: Build your target
        run: ./build_your_target.sh & # <- update this

      # Run Mayhem for Code
      - name: Mayhem for Code
        uses: ForAllSecure/mcode-action@v1
        continue-on-error: true
        with:
          sarif-output: sarif

      # Upload SARIF file (only available on public repos or github
      # enterprise). If you cannot use this action, other report format are
      # available (HTML, JUnit)
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: sarif