CID-17067 - Add renovate to update semgrep

.github/workflows/ci.yml

@@ -99,9 +99,3 @@ jobs:
       - name: Test Local Action
         id: test-action
         uses: ./
-        with:
-          milliseconds: 2000
-
-      - name: Print Output
-        id: output
-        run: echo "${{ steps.test-action.outputs.time }}"

.github/workflows/renovate.yaml

@@ -0,0 +1,28 @@
+name: Run renovate on k8s-actions-runner
+on:
+  schedule:
+    - cron: '0 15 * * 4'
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  renovate:
+    runs-on: xs-al2023
+    steps:
+      - uses: actions/checkout@v5
+      - uses: Workiva/gha-setup-credentials@v2.1.1
+      - id: create-github-app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: 1217319
+          private-key: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }}
+          owner: Workiva # This is needed for the target repo to read gha-security
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v43.0.12
+        with:
+          token: ${{ steps.create-github-app-token.outputs.token }}
+          configurationFile: 'renovate.json'
+        env:
+          LOG_LEVEL: info

renovate.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "repositories": ["Workiva/gha-security-scanner"],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/src/main.ts/", "/__tests__/main.test.ts"],
+      "matchStrings": [
+        "url:\\s*'https://github.com/semgrep/semgrep/archive/refs/tags/v(?<currentValue>\\d+\\.\\d+\\.\\d+)\\.tar\\.gz',\\s*version:\\s*'v\\d+\\.\\d+\\.\\d+'"
+      ],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "semgrep/semgrep"
+    }
+  ]
+}

src/main.ts

@@ -12,6 +12,12 @@ import * as scanner from './scanner.js'
  * @returns `Promise` that resolves when the operation is complete.
  */
 export async function run(): Promise<void> {
+  // Required to avoid the changes made in Semgrep Release v1.128.0
+  delete process.env.HTTP_PROXY
+  delete process.env.http_proxy
+  delete process.env.HTTPS_PROXY
+  delete process.env.https_proxy
+
   const scannerInput = inputs.getScannerInput()
 
   let scannerInstance: scanner.Scanner