semgrep.yaml

name: Semgrep

on:
  # Scan changed files in PRs, block on new issues only (existing issues ignored)
  pull_request: {}

jobs:
  semgrep:
    name: Scan
    runs-on: ubuntu-latest
    # Skip any PR created by dependabot to avoid permission issues
    if: (github.actor != 'dependabot[bot]')
    container:
      image: semgrep/semgrep:1.168.0@sha256:59fbed6127ea7c5dde3ba6a85142733bb20ea9aaa36120c953904f1539aaf66e
    steps:
      # Fetch project source
      - uses: actions/checkout@v7

      - name: Run Semgrep
        run: |
          semgrep scan \
            --sarif \
            --output=semgrep.sarif \
            --config="p/security-audit" \
            --config="p/secrets" \
            --config="p/ci" \
            --config="p/default" \
            --config="p/docker" \
            --config="p/dockerfile" \
            --config="p/command-injection"

      # Upload findings to GitHub Advanced Security Dashboard [step 2/2]
      - name: Upload SARIF file for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: semgrep.sarif