Skip to content

Semgrep

Semgrep #61

Workflow file for this run

# Name of this GitHub Actions workflow.
name: Semgrep
on:
schedule:
- cron: "30 14 * * *" # Sets Semgrep to scan every day at 12:30 UTC.
# It is recommended to change the schedule to a random time.
jobs:
semgrep:
# User definable name of this GitHub Actions job.
name: semgrep/ci
# If you are self-hosting, change the following `runs-on` value:
runs-on: ubuntu-latest
container:
# A Docker image with Semgrep installed. Do not change this.
image: returntocorp/semgrep
steps:
# Fetch project source with GitHub Actions Checkout.
- uses: actions/checkout@v3
# Fetch semgrep-rules with GitHub Actions Checkout.
- uses: actions/checkout@v3
with:
repository: semgrep/semgrep-rules
path: "./semgrep-rules"
# clone gitlab repo to fetch gitlab rules
- name: Clone private repo
run: git clone https://gitlab.com/gitlab-org/security-products/sast-rules.git
# Run the "semgrep ci --sarif" command on the command line of the docker image.
- run: semgrep ci --sarif > semgrep.sarif
env:
#SEMGREP_RULES: "./semgrep-rules/elixir/lang"
SEMGREP_RULES: "./sast-rules/javascript"
# Upload SARIF file generated in previous step
- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: semgrep.sarif
if: always()
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: semgrep.sarif
path: semgrep.sarif
if: always()