Create ghas.md

.github/workflows/ghas.yml

@@ -0,0 +1,42 @@
+# Reference: https://github.com/advanced-security/ghas-to-csv
+name: Gather data of GHAS
+on:
+  schedule:
+    - cron: '30 22 * * 1'  # Weekly at 22:30 UTC on Mondays
+  workflow_dispatch:
+jobs:
+  data_gathering:
+    runs-on: ubuntu-latest
+    steps:
+      - name: CSV export
+        uses: advanced-security/ghas-to-csv@v3
+      - name: Upload CSV
+        uses: actions/upload-artifact@v4
+        with:
+          name: ghas-data
+          path: ${{ github.workspace }}/*.csv
+          if-no-files-found: error
+  flat_data:
+    runs-on: ubuntu-latest
+    needs: [data_gathering]
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v3
+      - name: Download CSVs
+        uses: actions/download-artifact@v4
+        with:
+          name: ghas-data
+      - name: Tiny http server moment  # Flat can only use HTTP or SQL, so ... yeah.
+        run: |
+          docker run -d -p 8000:80 --read-only -v $(pwd)/nginx-cache:/var/cache/nginx -v $(pwd)/nginx-pid:/var/run -v $(pwd):/usr/share/nginx/html:ro nginx
+          sleep 10
+      - name: Flat the code scanning alerts
+        uses: githubocto/flat@v3
+        with:
+          http_url: http://localhost:8000/cs_list.csv
+          downloaded_filename: cs_list.csv
+      - name: Flat the secret scanning alerts
+        uses: githubocto/flat@v3
+        with:
+          http_url: http://localhost:8000/secrets_list.csv
+          downloaded_filename: secrets_list.csv

.gitignore

@@ -0,0 +1 @@
+nginx-pid/