semgrep.yml

name: Semgrep
permissions: read-all
on:
  pull_request: {}
  push:
    branches: [master, v2.dev, v3.dev]

jobs:
  semgrep:
    name: Scan
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    container:
      # Incompatible with Harden Runner
      image: returntocorp/semgrep
    steps:
      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
      - run: semgrep scan --sarif --output=results.sarif
        env:
          SEMGREP_RULES: >-
            p/java
            p/github-actions
            p/semgrep-rule-lints
            p/semgrep-misconfigurations
      - name: Check file existence
        id: check_files
        uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6 # v3.0.0
        with:
          files: results.sarif
      - name: Remove duplicate rules
        if: steps.check_files.outputs.files_exists == 'true'
        run: jq -c '.runs[0].tool.driver.rules |= unique_by(.id)' < results.sarif > semgrep.sarif
      - name: Upload SARIF file for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
        if: steps.check_files.outputs.files_exists == 'true'
        continue-on-error: true
        with:
          sarif_file: semgrep.sarif