semgrep-analysis.yml

name: Semgrep

on:
  # Scan changed files in PRs, block on new issues only (existing issues ignored)
  pull_request:

  push:
    branches: ["dev", "main"]

  schedule:
    - cron: '23 20 * * 1'

jobs:
  semgrep:
    name: Scan
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep
    # Skip any PR created by dependabot to avoid permission issues
    if: (github.actor != 'dependabot[bot]')
    steps:
      # Fetch project source
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2

      - run: semgrep scan --sarif --output=semgrep.sarif
        env:
          SEMGREP_RULES: >- # more at semgrep.dev/explore
            p/security-audit
            p/secrets
            p/owasp-top-ten

      - name: Upload SARIF file for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 #v3.29.0
        with:
          sarif_file: semgrep.sarif
        if: always()