pop.yml

name: POP - poutine on poutine

on:
  push:
    branches: [ main ]
    paths:
      - .github/workflows/**
      - action.yml

  pull_request:
    branches: [ main ]
    paths:
      - .github/workflows/**
      - action.yml

permissions:
  security-events: write
  contents: read

jobs:
  pop:
    runs-on: ubuntu-latest
    steps:
    - uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
      with:
        disable-sudo: true
        egress-policy: audit
        allowed-endpoints: >
          github.com:443
          api.github.com:443
          codeload.github.com:443
          objects.githubusercontent.com:443
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - uses: ./
      name: "Run poutine on poutine's own codebase"
      id: self-test

    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: results.sarif