From e7af89eee653d3df8314a9ebf4c7a8aa4c034017 Mon Sep 17 00:00:00 2001
From: Marco Manino <mrcmnn@gmail.com>
Date: Fri, 11 Jul 2025 16:32:19 +0200
Subject: [PATCH] chore: add flawfinder scan

---
 .github/workflows/security.yml | 64 ++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 .github/workflows/security.yml

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 000000000..5490376c4
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,64 @@
+name: C Security Scan
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  flawfinder:
+    name: Flawfinder scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install flawfinder
+        run: sudo apt-get update && sudo apt-get install -y flawfinder
+
+      - name: Run flawfinder
+        run: |
+          flawfinder --sarif -c src > flawfinder-report.json
+
+      - name: Format report
+        run: |
+          total=$(jq '.runs | map(.results) | add | length' flawfinder-report.json)
+          high=$(jq '.runs | map(.results) | add | map(select(.level == "error")) | length' flawfinder-report.json)
+          medium=$(jq '.runs | map(.results) | add | map(select(.level != "error")) | length' flawfinder-report.json)
+
+          echo "## Flawfinder scan" > flawfinder-report.md
+          echo "<details><summary>" >> flawfinder-report.md
+          echo "Total issues found: $total ($high HIGH | $medium MEDIUM)" >> flawfinder-report.md
+          echo "</summary>" >> flawfinder-report.md
+          echo "" >> flawfinder-report.md
+          echo "## Details" >> flawfinder-report.md
+          jq -r '.runs | map(.results) | add | .[] |
+            "\n\nAt `\(.locations[0].physicalLocation.artifactLocation.uri):\(.locations[0].physicalLocation.region.startLine)`
+          | Level | Rule |
+          |-|-|
+          |\(.level)|\(.ruleId)|
+
+          *\(.message.text)*\n
+          ```C
+          \(.locations[0].physicalLocation.region.snippet.text)
+          ```\n---\n\n"' flawfinder-report.json >> flawfinder-report.md
+
+          echo "</details>" >> flawfinder-report.md
+
+      - name: Comment flawfinder on PR
+        if: github.event_name == 'pull_request'
+        uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          path: flawfinder-report.md
+          header: flawfinder-scan
+
+      - name: Fail if flawfinder found high/critical issues
+        run: |
+          high=$(jq '.runs | map(.results) | add | map(select(.level == "error")) | length' flawfinder-report.json)
+          [[ high -gt 0 ]]