Speech MEAI (6/7): WAV sample app + package docs #224

	name: Semgrep

	on:
	# Scan changed files in PRs, block on new issues only (existing issues ignored)
	pull_request:

	push:
	branches: ["dev", "main"]

	schedule:
	- cron: "23 20 * * 1"

	# Manually trigger the workflow
	workflow_dispatch:

	permissions: {}

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	jobs:
	semgrep:
	name: Scan
	permissions:
	security-events: write # to upload SARIF results to code scanning
	contents: read # to check out the repository
	actions: read # to read workflow run metadata for code scanning
	runs-on: ubuntu-latest
	# Skip any PR created by dependabot to avoid permission issues
	if: (github.actor != 'dependabot[bot]')
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Run Semgrep
	uses: docker://returntocorp/semgrep@sha256:06938c1f365d3f67b8cedd8bc117607ae64253f88a0e768e9da9408548927dd6
	with:
	args: semgrep ci --sarif --output semgrep.sarif
	env:
	SEMGREP_RULES: >-
	p/security-audit
	p/secrets
	p/owasp-top-ten

	- name: Upload SARIF file for GitHub Advanced Security Dashboard
	uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
	with:
	sarif_file: semgrep.sarif
	if: always()

Navigation Menu