semgrep.yaml

---
name: Semgrep Analysis
on:
  merge_group:
  pull_request:
    branches:
      - main
    types:
      - opened
      - synchronize
      - reopened
  push:
    branches:
      - main
  schedule:
    - cron: "0 0 * * *" # Run daily at midnight UTC

concurrency:
  group: semgrep-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  actions: read
  checks: write
  contents: read
  pull-requests: write
  security-events: write

jobs:
  semgrep:
    name: Semgrep Analysis
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep@sha256:9349edbadf90c3f3c0c3f55867625354e89680e6fa10d9034042af52fdb0e0d0 # v1.160.0

    if: (github.actor != 'dependabot[bot]')

    steps:
      - name: Checkout git repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure Git Safe Directory
        run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"

      - name: Semgrep Analysis
        env:
          SEMGREP_RULES: >-
            p/terraform
            p/github-actions
            p/golang
            p/python
            p/docker
            p/secrets
            p/security-audit
            p/owasp-top-ten
            p/supply-chain
          SEMGREP_TIMEOUT: 300
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          semgrep ci \
            --config="${SEMGREP_RULES}" \
            --timeout="${SEMGREP_TIMEOUT}" \
            --sarif --output=semgrep-results.sarif

      - name: Upload SARIF to GitHub Security
        if: always()
        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
        with:
          sarif_file: semgrep-results.sarif