diff --git a/.github/workflows/powershell.yml b/.github/workflows/powershell.yml new file mode 100644 index 0000000..426f029 --- /dev/null +++ b/.github/workflows/powershell.yml @@ -0,0 +1,50 @@ +name: PSScriptAnalyzer-CrossPlatform + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '38 9 * * 5' + +permissions: + contents: read + +jobs: + analyze-powershell: + name: PowerShell Security Scan + runs-on: ${{ matrix.os }} + strategy: + matrix: + os: [ubuntu-latest, windows-latest, macos-latest] + + steps: + - uses: actions/checkout@v4 + + - name: Set up PowerShell + if: runner.os != 'Windows' + uses: actions/setup-powershell@v3 + + - name: Run PSScriptAnalyzer + shell: pwsh + run: | + # Determine repo root path based on OS + if ($IsWindows) { + $scanPath = ".\" + } else { + $scanPath = "." + } + + # Run PSScriptAnalyzer + Install-Module PSScriptAnalyzer -Force -Scope CurrentUser + $results = Invoke-ScriptAnalyzer -Path $scanPath -Recurse -Severity Error,Warning ` + | Where-Object { $_.RuleName -like "*Security*" } + + if ($results) { + $results | Format-Table + Write-Host "::error title=Security Scan::Potential security issues found in PowerShell scripts." + throw "Security issues detected by PSScriptAnalyzer" + } else { + Write-Host "::notice title=Security Scan::No common security issues found in PowerShell scripts." + }