aws-extensions-for-dotnet-cli/.github/workflows/semgrep-analysis.yml at a0cf7d76ddd90e862991d4dfb5d2467d966efcc3 · aws/aws-extensions-for-dotnet-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
name: Semgrep

on:
  # Scan changed files in PRs, block on new issues only (existing issues ignored)
  pull_request:

  push:
    branches: ["dev", "master"]

  schedule:
    - cron: '23 20 * * 1'

  # Manually trigger the workflow
  workflow_dispatch:

jobs:
  semgrep:
    name: Scan
    permissions:
      security-events: write
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep
    # Skip any PR created by dependabot to avoid permission issues
    if: (github.actor != 'dependabot[bot]')
    steps:
      # Fetch project source
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd #v4.2.2

      - run: semgrep ci --sarif > semgrep.sarif
        env:
          SEMGREP_RULES: >- # more at semgrep.dev/explore
            p/security-audit
            p/secrets
            p/owasp-top-ten

      - name: Upload SARIF file for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 #v4.32.0
        with:
          sarif_file: semgrep.sarif
        if: always()