semgrep-ci.yml

name: Semgrep

permissions:
    contents: read

on:
    workflow_dispatch: {}
    pull_request: {}
    push:
        branches:
            - main
        paths:
            - .github/workflows/semgrep-ci.yml
    schedule:
        # random HH:MM to avoid a load spike on GitHub Actions at 00:00
        - cron: '09 15 * * *'
jobs:
    semgrep:
        name: semgrep/ci
        runs-on: ubuntu-24.04
        env:
            SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
        container:
            image: semgrep/semgrep@sha256:b6a1bae371d313a8bddf0418b3e094e7cda4f1d77afeeecaa6b08c7f400349ff
        if: (github.actor != 'dependabot[bot]')
        steps:
            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
            - run: semgrep ci