feat(audit-bicep): update workflow to use PSRule analysis and improve configuration

Author: pauldotyu

.github/workflows/audit-bicep.yml

@@ -1,12 +1,12 @@
 name: Scan Bicep code
 on:
   push:
-    branches: 
+    branches:
       - main
     paths:
       - "infra/bicep/**"
   pull_request:
-    branches: 
+    branches:
       - main
     paths:
       - "infra/bicep/**"
@@ -19,17 +19,31 @@ jobs:
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-      - name: Run Microsoft Security DevOps Analysis
-        uses: microsoft/security-devops-action@preview
-        id: msdo
-        continue-on-error: true
+      - name: Bicep Build
+        uses: Azure/bicep-build-action@v1.0.0
+        with:
+          bicepFilePath: ./infra/bicep/main.bicep
+          outputFilePath: ./azuredeploy.json
+
+      - name: Run PSRule analysis
+        uses: microsoft/ps-rule@46451b8f5258c41beb5ae69ed7190ccbba84112c # v2.9.0
         with:
-          tools: templateanalyzer
+          modules: PSRule.Rules.Azure
+          baseline: Azure.Pillar.Security
+          inputPath: ./azuredeploy.json
+          outputFormat: Sarif
+          outputPath: reports/ps-rule-results.sarif
+          summary: true
+        continue-on-error: true
+
+        env:
+          PSRULE_CONFIGURATION_AZURE_BICEP_FILE_EXPANSION: "true"
+          PSRULE_CONFIGURATION_AZURE_BICEP_FILE_EXPANSION_TIMEOUT: "30"
 
       - name: Upload alerts to Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3
         if: github.repository_owner == 'Azure-Samples'
         with:
           sarif_file: ${{ steps.msdo.outputs.sarifFile }}