refactoring: directly use cabal-audit

.github/workflows/ci.yml

@@ -20,13 +20,11 @@ jobs:
         extra_nix_config: |
           system-features = nixos-test benchmark big-parallel kvm
     - uses: DeterminateSystems/magic-nix-cache-action@main
-    - run: nix build -L '.#packages.x86_64-linux."static-x86_64-unknown-linux-musl:github-action-scan:exe:github-action-scan"'
-    - run: nix flake check
     - name: Extract tag name
       shell: bash
       run: echo "tag=$(echo ${GITHUB_REF##*/})" >> $GITHUB_OUTPUT
       id: extract_tag
-    - run: nix build -L '.#packages.x86_64-linux.github-action-scan-image'
+    - run: nix build -L
     - run: docker load -i result
     - name: Log in to the Container registry
       if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v')

action.yaml

@@ -25,30 +25,20 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Log in to the Container registry
-      uses: docker/login-action@v3
-      with:
-        registry: ghcr.io
-        username: ${{ github.actor }}
-        password: ${{ inputs.token }}
     - name: Extract
       shell: bash
       env:
         CHECKOUT_PATH: ${{ inputs.checkout_path }}
       run: |
         cd "$CHECKOUT_PATH"
-        export IMG=ghcr.io/blackheaven/haskell-security-action:master
-        docker pull $IMG
-        docker create --name dummy $IMG
-        docker cp -L dummy:/bin/github-action-scan github-action-scan
-        docker rm -f dummy
+        wget https://github.com/blackheaven/cabal-audit/releases/download/nightly/cabal-audit
     - name: Run Haskell Security Action
       shell: bash
       env:
         CHECKOUT_PATH: ${{ inputs.checkout_path }}
       run: |
         cd "$CHECKOUT_PATH"
-        ./github-action-scan --sarif results.sarif
+        ./cabal-audit --sarif | tee results.sarif
         cat results.sarif
     - name: Upload SARIF file
       id: upload-sarif