From 32d753337fb451bab829590d567c2a200f8a7440 Mon Sep 17 00:00:00 2001
From: Yaron Sheffer <yaronf@gmx.com>
Date: Wed, 7 Oct 2026 00:45:11 +0300
Subject: [PATCH 1/3] Add GitHub Actions workflow for dhscanner SAST

---
 .github/workflows/dhscanner-sast.yml | 39 ++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/dhscanner-sast.yml

diff --git a/.github/workflows/dhscanner-sast.yml b/.github/workflows/dhscanner-sast.yml
new file mode 100644
index 0000000..dd54f17
--- /dev/null
+++ b/.github/workflows/dhscanner-sast.yml
@@ -0,0 +1,39 @@
+name: dhscanner-sast
+
+on:
+  push:
+    branches:
+      - main  
+
+jobs:
+  run-dhscanner:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: clone dhscanner (with submodules)
+        run: |
+          git clone --recurse-submodules https://github.com/OrenGitHub/dhscanner
+          cd dhscanner
+          docker compose -f compose.rel.x64.yaml up -d
+
+      - name: checkout specific tag
+        uses: actions/checkout@v4
+
+      - name: send the whole repo to dhscanner
+        run: |
+          tar -cz . | curl -v -X POST \
+            -H "X-Code-Sent-To-External-Server: false" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary @- http://127.0.0.1:443/ > output.sarif
+
+      - name: Upload SARIF results
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: output.sarif
+
+      - name: fail workflow if sarif contains findings
+        run: |
+          if jq '.runs[].results | length > 0' output.sarif | grep -q 'true'; then
+            echo "Sarif findings detected, failing the workflow"
+            exit 1
+          fi

From fdd1c73c2286572a4d47c4cc5634f5090f4c8df8 Mon Sep 17 00:00:00 2001
From: Yaron Sheffer <yaronf@gmx.com>
Date: Wed, 7 Oct 2026 00:49:42 +0300
Subject: [PATCH 2/3] Update workflow to include additional branches

Added support for 'chore/dhscanner-sast' branch and pull requests.
---
 .github/workflows/dhscanner-sast.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dhscanner-sast.yml b/.github/workflows/dhscanner-sast.yml
index dd54f17..c3aaa8b 100644
--- a/.github/workflows/dhscanner-sast.yml
+++ b/.github/workflows/dhscanner-sast.yml
@@ -3,7 +3,16 @@ name: dhscanner-sast
 on:
   push:
     branches:
-      - main  
+      - main
+      - chore/dhscanner-sast
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
 
 jobs:
   run-dhscanner:

From ac4ee6b4796a3d09f187be004a7723bf10d254e2 Mon Sep 17 00:00:00 2001
From: Yaron Sheffer <yaronf@gmx.com>
Date: Wed, 7 Oct 2026 00:54:01 +0300
Subject: [PATCH 3/3] Modify dhscanner clone step in workflow

Updated the clone command to specify the v1.0.0 branch and added a readiness check for dhscanner.
---
 .github/workflows/dhscanner-sast.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dhscanner-sast.yml b/.github/workflows/dhscanner-sast.yml
index c3aaa8b..fab6969 100644
--- a/.github/workflows/dhscanner-sast.yml
+++ b/.github/workflows/dhscanner-sast.yml
@@ -21,9 +21,20 @@ jobs:
     steps:
       - name: clone dhscanner (with submodules)
         run: |
-          git clone --recurse-submodules https://github.com/OrenGitHub/dhscanner
+          # Upstream main dropped compose.rel.*.yaml; docs still point at main.
+          git clone --recurse-submodules --branch v1.0.0 \
+            https://github.com/OrenGitHub/dhscanner
           cd dhscanner
           docker compose -f compose.rel.x64.yaml up -d
+          for i in $(seq 1 60); do
+            if (echo >/dev/tcp/127.0.0.1/443) >/dev/null 2>&1; then
+              exit 0
+            fi
+            sleep 5
+          done
+          echo "dhscanner did not become ready on :443"
+          docker compose -f compose.rel.x64.yaml ps
+          exit 1
 
       - name: checkout specific tag
         uses: actions/checkout@v4