dogfood.yml

name: QWED Verification Example

on:
  workflow_dispatch:  # Manual trigger
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

permissions:
  contents: read

jobs:
  scan-secrets:
    name: 🔐 Scan for Leaked Secrets
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Scan for API keys and tokens
        uses: ./  # Use local action
        with:
          action: scan-secrets
          paths: "**/*.env,**/*.json,**/*.yaml,**/*.yml"
          fail_on_findings: "false"  # Don't fail demo workflow

  scan-code:
    name: 🛡️ Scan Code for Security Issues
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Scan Python files for dangerous patterns
        uses: ./
        with:
          action: scan-code
          paths: "**/*.py"
          output_format: text
          fail_on_findings: "false"

  verify-shell:
    name: 💻 Verify Shell Scripts
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Check shell scripts for RCE patterns
        uses: ./
        with:
          action: verify-shell
          paths: "**/*.sh"
          fail_on_findings: "false"

  sarif-demo:
    name: 📊 SARIF Output Demo
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Scan with SARIF output
        uses: ./
        with:
          action: scan-code
          paths: "**/*.py"
          output_format: sarif
          fail_on_findings: "false"
      
      # Upload SARIF to GitHub Security tab (optional)
      # - name: Upload SARIF
      #   uses: github/codeql-action/upload-sarif@v2
      #   with:
      #     sarif_file: qwed-results.sarif