rl-security-scanner #345

	name: RL-Security-Scanner
	run-name: rl-security-scanner

	on:
	pull_request:
	types:
	- closed
	workflow_dispatch:

	permissions:
	id-token: write
	contents: write

	jobs:
	rl-scanner:
	name: Run Reversing Labs Scanner
	if: github.event_name == 'workflow_dispatch' \|\| (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	fetch-depth: 0

	- name: Build package
	shell: bash
	run: \|
	zip -r auth0-swift.zip ./*

	- name: Get Artifact Version
	id: get_version
	run: \|
	version=$(awk -F'"' '/let version/ {print $2}' Auth0/Version.swift)
	echo "version=$version" >> $GITHUB_OUTPUT

	- name: Run RL Scanner
	uses: auth0/devsecops-tooling/.github/actions/rl-scan@e29f26478db18ff0bcbe4bc447a8fbd54fbeec9e # main on 2026-06-09, TODO: use a release instead
	with:
	artifact-name: "auth0-swift"
	artifact-path: "${{ github.workspace }}/auth0-swift.zip"
	version: ${{ steps.get_version.outputs.version }}
	RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
	RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
	SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
	SIGNAL_HANDLER_DOMAIN: ${{ secrets.SIGNAL_HANDLER_DOMAIN }}
	PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
	PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
	PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
	PRODSEC_PYTHON_TOOLS_REPO: ${{ secrets.PRODSEC_PYTHON_TOOLS_REPO }}

Provide feedback