From b92ddec81b5f82f35bbb16cdec167d4f2c06bb4c Mon Sep 17 00:00:00 2001
From: Philip Meulengracht <the_meulengracht@hotmail.com>
Date: Thu, 24 Sep 2026 13:15:32 +0200
Subject: [PATCH] github: add cve-scanning to the CI

---
 .github/workflows/build-snap.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/build-snap.yml b/.github/workflows/build-snap.yml
index 47ba3ed..839a240 100644
--- a/.github/workflows/build-snap.yml
+++ b/.github/workflows/build-snap.yml
@@ -21,3 +21,14 @@ jobs:
       with:
         name: snap
         path: ${{ steps.snapcraft.outputs.snap }}
+    - name: Install CVE scanner
+      run: |
+        sudo snap install review-tools
+    - name: run CVE scanner
+      run: |
+        # this produces a table of detected CVEs and their severity
+        review-tools.scan-snap "${{ steps.snapcraft.outputs.snap }}" > "${{ github.workspace }}/cve-scan.txt"
+    - uses: actions/upload-artifact@v4
+      with:
+        name: cve-scan
+        path: "${{ github.workspace }}/cve-scan.txt"