security-code-scanner.yml

name: 'MetaMask Security Code Scanner'

on:
  push:
    branches: ['main']
  pull_request:

jobs:
  run-security-scan:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: MetaMask Security Code Scanner
        uses: MetaMask/Security-Code-Scanner@main
        with:
          repo: ${{ github.repository }}
          paths_ignored: |
            tests/
            '**/test/'
            '**/test-utils/'
            '**/__mocks__/'
            '**/__snapshots__/'
            '**/__fixtures__/'
            '**/*.test.js*'
            '**/*.test.ts*'
            '**/*.test.browser.ts*'
            docs/
            '**/jest.environment.js'
            '**/jest.config.js'
            node_modules
          project_metrics_token: ${{secrets.SECURITY_SCAN_METRICS_TOKEN}}
          slack_webhook: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}