ci: add semgrep check

.teamcity/builds/Build.kt

@@ -22,22 +22,30 @@ class Build(
             if (forPullRequests)
                 buildType(WhiteListCheck("${name}-whitelist-check", "white-list check"))
             if (forPullRequests) dependentBuildType(PRCheck("${name}-pr-check", "pr check"))
-            dependentBuildType(
-                Maven(
-                    "${name}-build",
-                    "build",
-                    "test-compile",
-                    "",
-                ),
-            )
-            dependentBuildType(
-                Maven(
-                    "${name}-test",
-                    "test",
-                    "verify",
-                    size = LinuxSize.LARGE,
-                ),
-            )
+
+            parallel {
+              dependentBuildType(SemgrepCheck("${name}-semgrep-check", "semgrep check"))
+
+              sequential {
+                dependentBuildType(
+                    Maven(
+                        "${name}-build",
+                        "build",
+                        "test-compile",
+                        "",
+                    ),
+                )
+                dependentBuildType(
+                    Maven(
+                        "${name}-test",
+                        "test",
+                        "verify",
+                        size = LinuxSize.LARGE,
+                    ),
+                )
+              }
+            }
+
             dependentBuildType(complete)
             if (!forPullRequests)
                 collectArtifacts(dependentBuildType(Release("${name}-release", "release")))

.teamcity/builds/Common.kt

@@ -15,6 +15,8 @@ const val MAVEN_DEFAULT_ARGS = "--no-transfer-progress --batch-mode --show-versi
 
 const val JAVA_VERSION = "11"
 
+const val SEMGREP_DOCKER_IMAGE = "semgrep/semgrep:1.146.0"
+
 enum class LinuxSize(val value: String) {
   SMALL("small"),
   LARGE("large")

.teamcity/builds/Maven.kt

@@ -4,7 +4,7 @@ import jetbrains.buildServer.configs.kotlin.BuildType
 import jetbrains.buildServer.configs.kotlin.buildFeatures.dockerSupport
 import jetbrains.buildServer.configs.kotlin.toId
 
-class Maven(
+open class Maven(
     id: String,
     name: String,
     goals: String,

.teamcity/builds/NightlyBuild.kt

@@ -0,0 +1,49 @@
+package builds
+
+import jetbrains.buildServer.configs.kotlin.Project
+import jetbrains.buildServer.configs.kotlin.sequential
+import jetbrains.buildServer.configs.kotlin.toId
+import jetbrains.buildServer.configs.kotlin.triggers.schedule
+import jetbrains.buildServer.configs.kotlin.triggers.vcs
+
+class NightlyBuild(name: String): Project({
+  this.id(name.toId())
+  this.name = name
+
+  val complete = Empty("${name}-complete", "complete")
+
+  val bts = sequential {
+    dependentBuildType(SemgrepCheck("${name}-semgrep-check", "semgrep check"))
+    dependentBuildType(complete)
+  }
+
+  bts.buildTypes().forEach {
+    it.thisVcs()
+
+    it.features {
+      enableCommitStatusPublisher()
+    }
+
+    buildType(it)
+  }
+
+  complete.triggers {
+    vcs { enabled = false }
+
+    schedule {
+      branchFilter = buildString {
+        appendLine("+:main")
+        appendLine("+:refs/heads/main")
+      }
+      schedulingPolicy = daily {
+        hour = 7
+        minute = 0
+      }
+      triggerBuild = always()
+      withPendingChangesOnly = false
+      enforceCleanCheckout = true
+      enforceCleanCheckoutForDependencies = true
+    }
+  }
+
+})

.teamcity/builds/SemgrepCheck.kt

@@ -0,0 +1,28 @@
+package builds
+
+import jetbrains.buildServer.configs.kotlin.buildSteps.ScriptBuildStep
+
+class SemgrepCheck(
+  id: String,
+  name: String
+): Maven(
+    id,
+    name,
+    "dependency:tree",
+    "-DoutputFile=maven_dep_tree.txt"
+) {
+
+  init {
+
+    params.password("env.SEMGREP_APP_TOKEN", "%semgrep-app-token%")
+
+    steps.step(ScriptBuildStep {
+      scriptContent="semgrep ci --no-git-ignore"
+      dockerImagePlatform = ScriptBuildStep.ImagePlatform.Linux
+      dockerImage = SEMGREP_DOCKER_IMAGE
+      dockerRunParameters =
+          "--volume /var/run/docker.sock:/var/run/docker.sock --volume %teamcity.build.checkoutDir%/signingkeysandbox:/root/.gnupg"
+    })
+  }
+
+}

.teamcity/settings.kts

@@ -1,4 +1,5 @@
 import builds.Build
+import builds.NightlyBuild
 import jetbrains.buildServer.configs.kotlin.project
 import jetbrains.buildServer.configs.kotlin.version
 
@@ -11,6 +12,7 @@ project {
     password("signing-key-passphrase", "%publish-signing-key-password%")
     password("github-commit-status-token", "%github-token%")
     password("github-pull-request-token", "%github-token%")
+    password("semgrep-app-token", "%semgrep-token%")
   }
 
   subProject(
@@ -37,4 +39,5 @@ project {
               """
                   .trimIndent(),
           forPullRequests = true))
+  subProject { NightlyBuild("nightly") }
 }