ENG-740 Use Amplify Security Github Action

[lae]

Updates workflow to use https://github.com/amplify-security/runner-action.

[amplify-lab]

✨ Amplify has finished checking this pull request

👍 Everything looks good! No issues detected in 📄 1 file and ❇️ 31 lines of code.

Security Pipeline

Tool	Configured	Result
Semgrep	✅	✅

Note

To ignore a finding, append @amplify-ignore in a comment to the end of the vulnerable line like // @amplify-ignore or # @amplify-ignore. For more details, visit Amplify Security.

[mwillfox]

👍🏻 I have already updated the TLS for prod to be correct so we can go ahead and merge this.

[lae]

Oh wait, is juice-shop not added to prod anyway? I can just keep this workflow only on lab if we want to keep it that way (and have our other real projects on prod).

0: Failed to mint a run token from Amplify. Please ensure that this repository is configured in Amplify.

[mwillfox]

Oh wait, is juice-shop not added to prod anyway? I can just keep this workflow only on lab if we want to keep it that way (and have our other real projects on prod).

0: Failed to mint a run token from Amplify. Please ensure that this repository is configured in Amplify.

Yes juice-shop is not in prod because we use prod as a production environment for our application code. I completely forgot. Let's go ahead and remove the call to prod and just run it on lab.

[amplify-lab]

✨ Amplify has finished checking this pull request

👍 Everything looks good! No issues detected in 📄 1 file and ❇️ 21 lines of code.

Security Pipeline

Tool	Configured	Result
Semgrep	✅	✅

Note

To ignore a finding, append @amplify-ignore in a comment to the end of the vulnerable line like // @amplify-ignore or # @amplify-ignore. For more details, visit Amplify Security.