semgrep.yaml

# Adapted from https://semgrep.dev/docs/semgrep-ci/sample-ci-configs
# Name of this GitHub Actions workflow.
name: Semgrep CE scan

on:
  # Scan changed files in PRs (diff-aware scanning):
  - pull_request

permissions:
  contents: read

jobs:
  semgrep:
    name: semgrep/scan

    container:
      # A Docker image with Semgrep installed. Do not change this.
      image: semgrep/semgrep

    # Skip any PR created by dependabot to avoid permission issues:
    if: (github.actor != 'dependabot[bot]')

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Run Semgrep
        run: semgrep ci --config auto --sarif-output=semgrep.sarif
      - name: Upload SARIF results
        if: failure()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif