test-semgrep.yml

name: Semgrep OSS scan

on:
  push:
    branches:
      - main
  schedule:
    - cron: "00 18 * * *" # Sets Semgrep to scan every day at 18:00 UTC.
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

jobs:
  semgrep:
    name: semgrep-oss/scan
    runs-on: ubuntu-latest
    container:
      # A Docker image with Semgrep installed. Do not change this.
      image: semgrep/semgrep

    # Skip any PR created by dependabot/renovatebot to avoid permission issues:
    if: (github.actor != 'dependabot[bot]' && github.actor != 'renovate[bot]')
    steps:
      - uses: actions/checkout@v4

      - id: semgrep_scan
        run: semgrep scan --config auto --sarif > semgrep.sarif

      - name: Upload SARIF file for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif
        if: always()