Semgrep Check #59

	name: Semgrep Check

	on:
	workflow_dispatch:
	pull_request:
	schedule:
	- cron: "0 7 * * *"

	jobs:
	build-dependency-tree:
	name: Build dependency tree
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

	- name: Set up Java
	uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
	with:
	distribution: temurin
	java-version: 11
	cache: 'maven'

	- name: Cleanup previous dependency tree files
	run: find . -type f -name 'maven_dep_tree.txt' -exec rm {} +

	- name: Build dependency tree
	run: ./mvnw dependency:tree -DoutputFile=maven_dep_tree.txt

	- name: Create Zip file
	run: find . -type f -name 'maven_dep_tree.txt' -exec zip -r maven-dependency-trees.zip {} +

	- name: Upload dependency zip file
	uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
	with:
	name: maven-dependency-trees
	path: maven-dependency-trees.zip

	semgrep-check:
	name: Run Semgrep scan
	runs-on: ubuntu-latest
	needs: build-dependency-tree
	env:
	SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
	container:
	image: semgrep/semgrep:1.146.0
	steps:
	- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

	- name: Download Maven dependency tree artifact
	uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
	with:
	name: maven-dependency-trees
	- name: Semgrep scan
	run: \|
	unzip -o maven-dependency-trees.zip
	semgrep ci --no-git-ignore

Provide feedback