Add Debricked starter workflow

[4ernovm]

Pre-requisites

• Prior to submitting a new workflow, please apply to join the GitHub Technology Partner Program: partner.github.com/apply.

---

Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.

---

Tasks

For all workflows, the workflow:

• Should be contained in a .yml file with the language or platform as its filename, in lower, kebab-cased format (for example, docker-image.yml). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
• Should use sentence case for the names of workflows and steps (for example, "Run tests").
• Should be named only by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
• Should include comments in the workflow for any parts that are not obvious or could use clarification.
• Should specify least privileged permissions for GITHUB_TOKEN so that the workflow runs successfully.

For Code Scanning workflows, the workflow:

• Should be preserved under the code-scanning directory.
• Should include a matching code-scanning/properties/*.properties.json file (for example, code-scanning/properties/codeql.properties.json), with properties set as follows:
  • name: Name of the Code Scanning integration.
  • creator: Name of the organization/user producing the Code Scanning integration.
  • description: Short description of the Code Scanning integration.
  • categories: Array of languages supported by the Code Scanning integration.
  • iconName: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in the icons directory.
• Should run on push to branches: [ $default-branch, $protected-branches ] and pull_request to branches: [ $default-branch ]. We also recommend a schedule trigger of cron: $cron-weekly (for example, codeql.yml).

[4ernovm]

@alexisabril I've noticed that you merged this PR #2234. Could you please advise what should be done to get this one merged as well?

[alexisabril]

Hi @4ernovm,

Thank you for the PR! I've added a few notes below, but I'm also looking to verify you as a TPP member. You checked the box that an application has been submitted, but I'm not seeing OpenText. Would you confirm if this application has been submitted and under which name?

[4ernovm]

Hi @4ernovm,

Thank you for the PR! I've added a few notes below, but I'm also looking to verify you as a TPP member. You checked the box that an application has been submitted, but I'm not seeing OpenText. Would you confirm if this application has been submitted and under which name?

Hello @alexisabril, thanks for the response. Our TPP membership is through Fortify/Micro Focus, which is still a legal entity under OpenText ownership. Would it be possible to somehow connect the TPP membership of Fortify/Micro Focus with OpenText? Also, if you have time, we have another workflow in this PR which needs a review as well, if you have the time: #2245. Thanks!

[alexisabril]

@4ernovm, would you email our team at [email protected] to verify your TPP membership? I want to make sure I identify the correct company and perhaps take this conversation outside of this issue.

[jsoref]

Suggested change

	vulnerabilities-scan:
	vulnerabilities-scan:
	name: Vulnerabilities scan

[jsoref]

Suggested change

	- uses: actions/checkout@v3
	- uses: actions/checkout@v4

[jsoref]

Personal preference:

Suggested change

	on: [push]
	on:
	push:

This makes it easier for people to make changes to the workflow w/o taking blame for lines that they aren't conceptually changing.

[github-actions]

This pull request has become stale and will be closed automatically within a period of time. Sorry about that.