From e570d2dbce3312b2e68449baa000592f295c552a Mon Sep 17 00:00:00 2001
From: Raghib <raghib.anwar@razorpay.com>
Date: Tue, 19 Jul 2022 15:30:05 +0530
Subject: [PATCH] Added package vulnerability check

---
 .github/workflows/semgrep.yml | 40 +++++++++++++++++++++--------------
 1 file changed, 24 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 60f53777..5ac3fc40 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -1,20 +1,28 @@
 name: Semgrep
 on:
-  pull_request: {}
+  workflow_dispatch:
+  pull_request: { }
   push:
-    branches: ["master"]
+    branches: [ "master" ]
+  schedule:
+    - cron: '30 20 * * *'
 jobs:
-  semgrep:
-    name: Scan
-    runs-on: ubuntu-latest
-    # Skip any PR created by dependabot to avoid permissioning issues
-    if: (github.actor != 'dependabot[bot]')
-    steps:
-      - uses: actions/checkout@v2
-      - uses: returntocorp/semgrep-action@v1
-        with:
-          auditOn: push
-          publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}
-          publishDeployment: 339
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  security-sast:
+    uses: razorpay/security-action/.github/workflows/semgrep.yml@master
+    secrets:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+
+  security-packagevulnerability:
+    uses: razorpay/security-action/.github/workflows/package_scan.yml@master
+    with:
+      PROGRAMMING_LANGUAGE: GO
+    secrets:
+      GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
+
+
+  security-statuscheck:
+    needs: [ security-sast ]
+    if: always()
+    uses: razorpay/security-action/.github/workflows/status_check.yml@master
+    with:
+      WORKFLOW_RESULT: ${{ needs.security-sast.result == 'success' && needs.security-sast.result != 'cancelled' || 'false' }}