name: Semgrep
on:
push:
branches: [main]
pull_request:
types: [opened, synchronize, ready_for_review, reopened]
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
semgrep:
name: Static analysis
runs-on: ubuntu-latest
container:
image: semgrep/semgrep@sha256:a3d49dc967b8534a6a76628e50c51cbfe33eb7195dc2feab1fdc0f100852c8ef
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- name: Run Semgrep
run: semgrep scan --config p/rust --error