initial commit

.github/workflows/genesis_public.yml

@@ -0,0 +1,11 @@
+name: Semgrep Scans
+on:
+  pull_request: {}
+  push:
+    branches: ["master"]
+  schedule:
+    - cron: "0 17 * * *"
+jobs:
+  Security-Scan:
+    uses: razorpay/genesis/.github/workflows/semgrep.yml@master
+    secrets: inherit

.github/workflows/semgrep.yml

@@ -0,0 +1,21 @@
+name: Scan
+
+on:
+  workflow_call:
+    secrets:
+      SEMGREP_APP_TOKEN:
+        required: true
+        description: "required for scan"
+
+jobs:
+  public-repo-job:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.repository.private == false }}
+    container:
+      image: semgrep/semgrep
+    steps:
+      - uses: actions/checkout@v4.0.0
+      - name: run on public repo
+        run: semgrep ci &> /dev/null
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}