browserstack-local-java/.github/workflows/Semgrep.yml at master · browserstack/browserstack-local-java · GitHub

View runs

History

49 lines (41 loc) · 1.75 KB

Raw

# Name of this GitHub Actions workflow.

name: Semgrep

on:

# Scan changed files in PRs (diff-aware scanning):

# The branches below must be a subset of the branches above

pull_request:

branches: ["master", "main"]

push:

branches: ["master", "main"]

schedule:

- cron: '0 6 * * *'

permissions:

contents: read

jobs:

semgrep:

# User definable name of this GitHub Actions job.

permissions:

contents: read # for actions/checkout to fetch code

security-events: write # for github/codeql-action/upload-sarif to upload SARIF results

name: semgrep/ci

# If you are self-hosting, change the following `runs-on` value:

runs-on: ubuntu-latest

container:

# A Docker image with Semgrep installed. Do not change this.

# Pinned by digest (LOC-6730 / INF-002) — tag-mutation is a supply-chain vector.

image: returntocorp/semgrep@sha256:9349edbadf90c3f3c0c3f55867625354e89680e6fa10d9034042af52fdb0e0d0

# Skip any PR created by dependabot to avoid permission issues:

if: (github.actor != 'dependabot[bot]')

steps:

# Fetch project source with GitHub Actions Checkout.

- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

# Run the "semgrep ci" command on the command line of the docker image.

- run: semgrep ci --sarif --output=semgrep.sarif

env:

# Add the rules that Semgrep uses by setting the SEMGREP_RULES environment variable.

SEMGREP_RULES: p/default # more at semgrep.dev/explore

- name: Upload SARIF file for GitHub Advanced Security Dashboard

uses: github/codeql-action/upload-sarif@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # v2.20.0

with:

sarif_file: semgrep.sarif

if: always()

browserstack-local-java/.github/workflows/Semgrep.yml at master · browserstack/browserstack-local-java · GitHub

Uh oh!

Expand file tree

Breadcrumbs

Semgrep.yml

Latest commit

History

Breadcrumbs

Semgrep.yml

File metadata and controls