semgrep-check.yml

# Name of this GitHub Actions workflow.
name: Semgrep

on:
  # Scan mainline branches and report all findings: 
  push:
    branches:
        - main
  # Scan changed files in PRs (diff-aware scanning):
  pull_request:

jobs:
  semgrep:
    # User-definable name of this GitHub Actions job:
    name: Semgrep Workflow Security Scan
    # If you are self-hosting, change the following `runs-on` value: 
    runs-on: ubuntu-24.04

    container:
      # A Docker image with Semgrep installed. Do not change this.
      image: returntocorp/semgrep@sha256:37736e4992c539f760e36e14d48924bd9fa70d0abbde39a6d86d93f66a1affd4

    # To skip any PR created by dependabot to avoid permission issues:
    if: (github.actor != 'dependabot[bot]')

    steps:
      # Fetch project source with GitHub Actions Checkout.
      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3
      # Run the "semgrep ci" command on the command line of the docker image.
      - run: semgrep ci
        env:
           # Add the rules that Semgrep uses by setting the SEMGREP_RULES environment variable. 
           SEMGREP_RULES: p/github-actions