chore(main): release 4.2.1 (#490) #99

	---
	# yamllint disable rule:comments
	# yamllint disable rule:truthy
	name: InfraScan Security Audit

	on:
	push:
	branches:
	- main
	pull_request:
	branches:
	- main

	permissions: {} # Default deny; jobs declare only the permissions they need.

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: false

	jobs:
	infrascan:
	name: Run InfraScan
	runs-on: ubuntu-latest
	timeout-minutes: 45
	permissions:
	contents: read # Required to checkout repository content for scanning.
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
	with:
	egress-policy: audit

	- name: Checkout repository
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Prepare InfraScan input
	shell: bash
	run: \|
	rm -rf .infrascan-src
	mkdir -p .infrascan-src
	rsync -a --delete \
	--exclude='.git/' \
	--exclude='.infrascan-src/' \
	--exclude='docs/' \
	--exclude='test/' \
	--exclude='tests/' \
	--exclude='example/' \
	--exclude='examples/' \
	--exclude='*.tftest.hcl' \
	./ .infrascan-src/

	- name: Run InfraScan
	uses: soldevelo/infrascan@bf26ef988a5a9a4f303e5b9c5753ea66ccc9da87 # v1.0.10
	with:
	directory: .infrascan-src
	scanner: comprehensive
	format: html
	out: infrascan-report.html
	fail-on: high_critical

	- name: Upload HTML report
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	if: always()
	with:
	name: infrascan-report
	path: infrascan-report.html

Provide feedback