Skip to content

Commit

Permalink
[azp] Support Semgrep (#132)
Browse files Browse the repository at this point in the history
#### Why I did it
[Semgrep](https://github.com/returntocorp/semgrep) is a static analysis tool to find security vulnerabilities.

Ref: - [Supported Language](https://semgrep.dev/docs/supported-languages/#language-maturity) - [Semgrep Rules](https://registry.semgrep.dev/rule)
#### How I did it
Integrate Semgrep into this repository by committing a job configuration file
When this PR merged, it forces developers to follow and must pass Semgrep checker
  • Loading branch information
maipbui authored Jan 9, 2023
1 parent 6a281c8 commit c7411ff
Showing 1 changed file with 18 additions and 0 deletions.
18 changes: 18 additions & 0 deletions azure-pipelines.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,24 @@ pr:
- master

stages:
- ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
- stage: Analysis
dependsOn: []
jobs:
- job:
displayName: "Semgrep"
pool:
vmImage: ubuntu-latest
steps:
- script: |
set -ex
target_branch=origin/$(System.PullRequest.TargetBranch)
files_changed=$(git --no-pager diff $target_branch..HEAD --name-only --diff-filter=d)
python -m pip install --upgrade pip
pip install semgrep
semgrep --config "p/default" --error $files_changed
displayName: 'Run Semgrep'
- stage: Build
jobs:
- job:
Expand Down

0 comments on commit c7411ff

Please sign in to comment.