clj-holmes/clj-holmes-action

Action to execute clj-holmes in Clojure/Clojurescript projects.

clj-holmes action

Action to execute clj-holmes in Clojure/Clojurescript projects.

Getting Started

Simply add the following snippet to your GitHub actions workflow.

- name: Scan
  uses: clj-holmes/clj-holmes-action@main

Inputs

It's also possible to specify the following:

• rule-repository, it can be an public or private git repository [Default: git://clj-holmes/clj-holmes-rules#main]
• output-type (json, sarif or stdout) [Default: sarif]
• output-file [Default: clj_holmes_scan_results.txt]
• fail-on-result (true or false) [Default: false]

- name: Scan
  uses: clj-holmes/clj-holmes-action@main
  with:
    rules-repository: 'git://org/private-rules-repo#main'
    output-type: 'json'
    output-file: 'scan-results.json'
    fail-on-result: 'true'
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

clj-holmes-action's Issues

Security Policy violation SECURITY.md

Allstar has detected that this repository’s SECURITY.md security policy is out of compliance. Status:
Security policy not enabled.
A SECURITY.md file can give users information about what constitutes a vulnerability and how to report one securely so that information about a bug is not publicly visible. Examples of secure reporting methods include using an issue tracker with private issue support, or encrypted email with a published key.

To fix this, add a SECURITY.md file that explains how to handle vulnerabilities found in your repository. Go to https://github.com/clj-holmes/clj-holmes-action/security/policy to enable.

For more information, see https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository.

This issue will auto resolve when the policy is in compliance.

Issue created by Allstar. See https://github.com/ossf/allstar/ for more information. For questions specific to the repository, please contact the owner or maintainer.

No

No rules seem to be used when the default rules database is used.

Action setup:

      - name: Scan
        uses: clj-holmes/clj-holmes-action@main
        with:
     #     rules-repository: 'git://clj-holmes/clj-holmes-rules#main'
          output-type: 'sarif'
          output-file: 'clj-holmes-results.sarif'
          fail-on-result: 'false'
          verbose: 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.TOKEN }}

The results don't show the rules used and as a result the are no violations found.

{"$schema":"https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"clj-holmes","informationUri":"https://github.com/clj-holmes/clj-holmes","version":"1.4.3","rules":[]}},"results":[]}]}

Security Policy violation Branch Protection

Allstar has detected that this repository’s Branch Protection security policy is out of compliance. Status:
No protection found for branch main

This issue will auto resolve when the policy is in compliance.

Issue created by Allstar. See https://github.com/ossf/allstar/ for more information. For questions specific to the repository, please contact the owner or maintainer.