microsoft-defender-for-devops.yml

---
name: Microsoft Defender for Devops
on:
  workflow_call:
    inputs:
      dotnet-version:
        required: false
        type: string
        description: .NET version to use
        default: 6.0.x
      runs-on:
        required: false
        type: string
        description: Runner to use
        default: windows-latest
permissions:
  contents: read
  security-events: write
jobs:
  msdo:
    runs-on: ${{ inputs.runs-on }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          fetch-depth: 1
          persist-credentials: false
      - name: Setup .NET
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7  # v5.2.0
        with:
          dotnet-version: ${{ inputs.dotnet-version }}
      - name: Run Microsoft Security DevOps
        uses: microsoft/security-devops-action@08976cb623803b1b36d7112d4ff9f59eae704de0  # v1.12.0
        id: msdo
      - name: Upload results to Security tab
        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225  # v4.35.2
        with:
          sarif_file: ${{ steps.msdo.outputs.sarifFile }}