name: 'Run Semgrep'
on:
pull_request:
push:
branches:
- "main"
permissions:
contents: read
pull-requests: read
concurrency:
group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
cancel-in-progress: true
jobs:
semgrep:
runs-on: "ubuntu-latest"
timeout-minutes: 30
container:
image: "returntocorp/semgrep"
if: (github.actor != 'dependabot[bot]')
env:
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
SEMGREP_REPO_URL: ${{ github.repositoryUrl }}
SEMGREP_BRANCH: ${{ github.ref_name }}
SEMGREP_BASELINE_REF: ${{ github.base_ref }}
steps:
- name: Checkout
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 - name: Run semgrep
run: semgrep ci