From 7628bc60ca354cbe8082aabc1608d93246893fd3 Mon Sep 17 00:00:00 2001
From: GabrielVasilescu04 <gabriel.vasilescu@uipath.com>
Date: Tue, 7 Oct 2025 17:18:29 +0300
Subject: [PATCH] chore: add security scans

---
 .pipelines/security-scans.yml | 53 +++++++++++++++++++++++++++++++++++
 .pipelines/variables.yml      |  2 ++
 2 files changed, 55 insertions(+)
 create mode 100644 .pipelines/security-scans.yml
 create mode 100644 .pipelines/variables.yml

diff --git a/.pipelines/security-scans.yml b/.pipelines/security-scans.yml
new file mode 100644
index 0000000..99caf5d
--- /dev/null
+++ b/.pipelines/security-scans.yml
@@ -0,0 +1,53 @@
+trigger: none
+pr: none
+
+schedules:
+  - cron: "0 11 * * 1"
+    displayName: "Every Monday at 1:00 PM"
+    branches:
+      include:
+        - main
+    always: true
+
+resources:
+  repositories:
+    - repository: codeql
+      type: github
+      name: UiPath/AzurePipelinesTemplates
+      ref: refs/tags/uipath.security.codeql.1.9.5
+      endpoint: UiPath
+    - repository: fossa
+      type: github
+      name: UiPath/AzurePipelinesTemplates
+      ref: refs/tags/uipath.security.fossa.3.0.13
+      endpoint: UiPath
+
+variables:
+  - template: ./variables.yml
+
+stages:
+  - stage: FOSSA
+    dependsOn: []
+    jobs:
+      - job: FOSSA
+        steps:
+          - template: Security/fossa.steps.yml@fossa
+            parameters:
+              OS: linux
+              azureSubscription: $(azureInternalProductionEaConnectionName)
+              FOSSAFlags: '--project "UiPath MCP Python SDK" --branch "$(Build.SourceBranch)" --revision "$(Build.SourceVersion)-$(Build.BuildId)"'
+              FOSSATestFlags: '--project "UiPath MCP Python SDK" --revision "$(Build.SourceVersion)-$(Build.BuildId)"'
+              ${{ if contains(variables['Build.SourceBranch'], 'main') }}:
+                publishSecurityReports: true
+
+
+  - stage: CODEQL
+    dependsOn: []
+    jobs:
+      - job: CODEQL
+        steps:
+          - template: Security/codeql.interpreted.steps.yml@codeql
+            parameters:
+              os: 'linux64'
+              language: 'python'
+              azureSubscription: $(azureInternalProductionEaConnectionName)
diff --git a/.pipelines/variables.yml b/.pipelines/variables.yml
new file mode 100644
index 0000000..203be10
--- /dev/null
+++ b/.pipelines/variables.yml
@@ -0,0 +1,2 @@
+variables:
+  azureInternalProductionEaConnectionName: Internal-Production-EA
\ No newline at end of file