# Darkwing vulnerability scan, manual dispatch.
#
# Copied verbatim from the ge-aero/darkwing README so it stays byte-identical
# to the sanctioned integration. Do not edit this file to add triggers or
# gating - see scan-darkwing-pr.yml for that, which is ours to change.
#
# The file must sit on the default branch before a scan can run on ANY branch.
name: Scan (darkwing, portable)

on:
  workflow_dispatch:
    inputs:
      target_ref:
        description: Ref, branch, or sha of this repo to scan
        required: false
        type: string
        default: main

permissions:
  contents: read # checkout this repo via the ambient GITHUB_TOKEN
  security-events: write # SARIF upload to the Security tab
  actions: read # required by upload-sarif on private/internal repos

jobs:
  scan:
    runs-on: darkwing-scan
    steps:
      # @v1 is a moving tag pointing to the latest release that is compatible
      # with this workflow file.
      - uses: ge-aero/darkwing@v1
        with:
          target_ref: ${{ inputs.target_ref || 'main' }}