lula.yaml

# Copyright 2025 Defense Unicorns
# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial

# This workflow runs a Lula scan against the PR to see if compliance has changed

name: Lula Scan

on:
  pull_request:
    branches: ["main"]
    # milestoned is added here as a workaround for release-please not triggering PR workflows (PRs should be added to a milestone to trigger the workflow).
    # labeled is added to support renovate-ready labelling on PRs
    types: [milestoned, labeled, opened, reopened, synchronize]
permissions:
  contents: read
  pull-requests: write

jobs:
  scan-pr:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Use Node.js 22
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: "npm"
      - name: Run Lula Scan
        run: |
          # renovate: datasource=github-tags depName=defenseunicorns/lula versioning=semver
          npx --yes lula2@0.9.5 crawl
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}