diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml deleted file mode 100644 index a64c382610..0000000000 --- a/.github/workflows/semgrep.yml +++ /dev/null @@ -1,40 +0,0 @@ -name: Semgrep - -on: - pull_request: - branches: ["dev"] - -permissions: - actions: read - contents: read - security-events: write - -jobs: - semgrep: - name: semgrep/ci - runs-on: ubuntu-latest - - container: - image: returntocorp/semgrep - - # Skip any PR created by dependabot to avoid permission issues: - if: ${{ github.actor != 'dependabot[bot]' }} - - steps: - - uses: actions/checkout@v4 - with: - show-progress: false - - - name: "Run the 'semgrep ci' command on the command line of the docker image." - continue-on-error: true - run: semgrep ci --sarif --output=semgrep.sarif --config auto --config "p/gitlab" --exclude-rule yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha - env: - # Add the rules that Semgrep uses by setting the SEMGREP_RULES environment variable. - # more at semgrep.dev/explore - SEMGREP_RULES: p/default - - - name: Upload SARIF file for GitHub Advanced Security Dashboard - if: always() - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: semgrep.sarif