Problem: persist-credentials might leak github token unintentionally #786

	name: Run Gosec
	on:
	pull_request:
	merge_group:
	push:
	branches:
	- master
	- release/**

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	Gosec:
	runs-on: ubuntu-latest
	permissions:
	actions: read
	contents: read
	security-events: write
	env:
	GO111MODULE: on
	steps:
	- uses: actions/checkout@v4
	- id: changed-files
	uses: tj-actions/changed-files@v41
	with:
	files: \|
	*/.go
	go.mod
	go.sum
	- name: Run Gosec Security Scanner
	uses: informalsystems/gosec@master
	with:
	# we let the report trigger content trigger a failure using the GitHub Security features.
	args: '-no-fail -fmt sarif -out results.sarif ./...'
	if: steps.changed-files.outputs.any_changed == 'true'
	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@v2
	with:
	# Path to SARIF file relative to the root of the repository
	sarif_file: results.sarif
	if: steps.changed-files.outputs.any_changed == 'true'

Provide feedback