feat: update ossar.yml

.github/workflows/ossar.yml

@@ -1,56 +1,40 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-# This workflow integrates a collection of open source static analysis tools
-# with GitHub code scanning. For documentation, or to provide feedback, visit
-# https://github.com/github/ossar-action
-name: OSSAR
-
+name: OSSAR Scan
 on:
   push:
-    branches: [ "main" ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ "main" ]
-  schedule:
-    - cron: '29 14 * * 1'
-
-permissions:
-  contents: read
+    branches:
+      - main
+      - v1
 
 jobs:
-  OSSAR-Scan:
+  sample:
+    name: Open Source Static Analysis Runner
+
     # OSSAR runs on windows-latest.
-    # ubuntu-latest and macos-latest support coming soon
-    permissions:
-      contents: read # for actions/checkout to fetch code
-      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
-    runs-on: windows-latest
+    # ubuntu-latest and macos-latest supporting coming soon
+    runs-on: ubuntu-latest
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
+
+      # Checkout your code repository to scan
+    - uses: actions/checkout@v2
 
     # Ensure a compatible version of dotnet is installed.
-    # The [Microsoft Security Code Analysis CLI](https://aka.ms/mscadocs) is built with dotnet v3.1.201.
-    # A version greater than or equal to v3.1.201 of dotnet must be installed on the agent in order to run this action.
+    # The [Microsoft Security DevOps CLI](https://aka.ms/msdo-nuget) is built with net6.0
+    # A version greater than or equal to net6.0 of dotnet must be installed on the agent in order to run this action.
     # GitHub hosted runners already have a compatible version of dotnet installed and this step may be skipped.
+
     # For self-hosted runners, ensure dotnet version 3.1.201 or later is installed by including this action:
-    # - name: Install .NET
-    #   uses: actions/setup-dotnet@v2
+    # - uses: actions/setup-dotnet@v1
     #   with:
-    #     dotnet-version: '3.1.x'
+    #     dotnet-version: '6.0.x'
 
       # Run open source static analysis tools
     - name: Run OSSAR
       uses: github/ossar-action@v1
       id: ossar
 
       # Upload results to the Security tab
-    - name: Upload OSSAR results
+    - name: Upload results to Security tab
       uses: github/codeql-action/upload-sarif@v2
       with:
         sarif_file: ${{ steps.ossar.outputs.sarifFile }}