nomyo-js/.forgejo/workflows/nyxscanner.yml

name: NYX Security Scan

on:
  pull_request:
    branches: [main, master]

jobs:
  nyx-scan:
    runs-on: docker-amd64

    steps:
      - name: Checkout PR
        uses: https://code.forgejo.org/actions/checkout@v4

      - name: Clone nyx from Forgejo mirror
        run: |
          git clone --depth=1 --branch master \
            https://bitfreedom.net/code/apunkt/nyx .nyx-src

      - name: Install Rust
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH

      - name: Build nyx from source
        run: |
          cd .nyx-src
          cargo build --release
          sudo cp target/release/nyx /usr/local/bin/nyx

      - name: Run NYX scan
        run: |
          nyx scan --format sarif --fail-on MEDIUM > nyx-results.sarif

      - name: Upload SARIF results
        if: always()
        uses: https://code.forgejo.org/actions/upload-artifact@v4
        with:
          name: nyx-sarif-report
          path: nyx-results.sarif