decidim/decidim

name: "[CI] Brakeman"

on:
  push:
    branches:
      - develop
      - release/*
      - "*-stable"
  pull_request:
    branches-ignore:
      - "chore/l10n*"

env:
  CI: "true"
  RUBY_VERSION: 3.2.2
  NODE_VERSION: 18.17.1
  PARALLEL_TEST_PROCESSORS: 2
  CODECOV_TOKEN: bc15b944-6b42-420a-b3f9-a5a8fb214326
  SHAKAPACKER_RUNTIME_COMPILE: "false"

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  brakeman:
    strategy:
      fail-fast: false
      matrix:
        working-directory:
          - decidim-accountability
          - decidim-admin
          - decidim-api
          - decidim-assemblies
          - decidim-blogs
          - decidim-budgets
          - decidim-comments
          - decidim-conferences
          - decidim-core
          - decidim-debates
          - decidim-dev
          - decidim-forms
          - decidim-initiatives
          - decidim-meetings
          - decidim-pages
          - decidim-participatory_processes
          - decidim-proposals
          - decidim-sortitions
          - decidim-surveys
          - decidim-system
          - decidim-templates
          - decidim-verifications
    runs-on: ubuntu-latest
    name: ${{ matrix.working-directory }}
    if: "!startsWith(github.head_ref, 'chore/l10n')"
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 1
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: ${{ env.RUBY_VERSION }}
          bundler-cache: true
      - run: bundle exec brakeman --rails6 --force-scan .
        name: Scanning Security issues on module
        working-directory: ${{ matrix.working-directory }}
        shell: "bash"