semgrep.yml

name: Semgrep
on:
  push:
    branches:
      - main
  schedule:
    - cron: 0 1 * * *

permissions: read-all

jobs:
  semgrep:
    name: Semgrep
    runs-on: ubuntu-24.04
    permissions:
      security-events: write # To upload SARIF results
    container:
      image: semgrep/semgrep
    steps:
      - name: Checkout repository
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
        with:
          persist-credentials: false
      - name: Perform Semgrep analysis
        run: semgrep ci --sarif --output semgrep.sarif
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
      - name: Upload Semgrep report to GitHub
        uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
        if: ${{ failure() || success() }}
        with:
          sarif_file: semgrep.sarif