-
Notifications
You must be signed in to change notification settings - Fork 0
39 lines (37 loc) · 1.06 KB
/
semgrep.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
name: Semgrep
on:
push:
branches:
- main
permissions: read-all
jobs:
semgrep:
name: Semgrep
runs-on: ubuntu-22.04
permissions:
security-events: write # To upload SARIF results
container:
image: returntocorp/semgrep
steps:
- name: Checkout repository
uses: actions/checkout@v4.1.6
- name: Install Go
uses: actions/setup-go@v5.0.2
with:
go-version-file: go.mod
- name: Verify action checksums
env:
JOB: ${{ github.job }}
WORKFLOW: ${{ github.workflow_ref }}
run: |
WORKFLOW=$(echo "$WORKFLOW" | cut -d '@' -f 1 | cut -d '/' -f 3-5)
go run ./cmd/ghasum verify -cache /__w/_actions -no-evict -offline "$WORKFLOW:$JOB"
- name: Perform Semgrep analysis
run: semgrep ci --sarif --output semgrep.sarif
env:
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
- name: Upload Semgrep report to GitHub
uses: github/codeql-action/upload-sarif@v3.26.0
if: ${{ failure() || success() }}
with:
sarif_file: semgrep.sarif