semgrep.yml

name: semgrep

on:
  push:
    branches-ignore:
      # Error: Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#scanning-on-push for more information on how to configure these events.
      - dependabot/**
  pull_request:

jobs:
  semgrep:
    runs-on: ubuntu-latest

    container:
      image: returntocorp/semgrep

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run semgrep
        run: semgrep scan --config .semgrep/ --sarif > semgrep.sarif

      - name: Upload SARIF file to GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif
        if: always()