static-analysis-semgrep.yml

name: "Semgrep"

on:
  push:
    branches: [ "main" ]
  pull_request_target: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  semgrep:
    name: Analyze Semgrep
    runs-on: ubuntu-latest
    container: returntocorp/semgrep
    if: (github.actor != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
      - name: Register workspace path
        if: ${{ github.event.number > 0 }}
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Checkout Pull Request
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        id: checkout
        if: ${{ github.event.number > 0 }}
        run: |
          apk add github-cli
          gh pr checkout ${{ github.event.number }}

      - run: semgrep ci --sarif --output=semgrep.sarif
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

      - name: Upload SARIF file for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif
        if: ${{ github.event.number == '' && !cancelled() }}