Use flawfinder --exclude instead of listing directories

Flawfinder 2.0.20 has an --exclude PATTERN option. Scan `./` and exclude `*/single_include/*` so that new top-level directories are covered automatically. The scanned file set is identical to the explicit directory list. Signed-off-by: Niels Lohmann <mail@nlohmann.me>
2026-10-26 12:14:46 +00:00 · 2026-10-26 08:21:42 +01:00
1 changed files with 2 additions and 2 deletions
@@ -43,8 +43,8 @@ jobs:
      - name: flawfinder_scan
        uses: david-a-wheeler/flawfinder@c4216b74cf2639ffa98503768bd6e4299b5440c9 # v2.0.20
        with:
-          # single_include/ is omitted: it is generated from include/ and would report every finding twice
-          arguments: '--sarif ./cmake ./docs ./include ./src ./tests ./tools'
+          # single_include/ is generated from include/ and would report every finding twice
+          arguments: "--sarif --exclude '*/single_include/*' ./"
          output: 'flawfinder_results.sarif'

      - name: Upload analysis results to GitHub Security tab