Skip to content

brave-isolated-world.yaml: catch extra regex #721

brave-isolated-world.yaml: catch extra regex

brave-isolated-world.yaml: catch extra regex #721

name: semgrep-self-test
on:
workflow_dispatch:
push:
branches: [main]
pull_request:
types: [opened, synchronize, reopened, ready_for_review]
branches: [main]
jobs:
semgrep-self-test:
name: semgrep-self-test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- run: |
python3 -m pip --disable-pip-version-check install -r requirements.txt
shell: bash
- run: |
semgrep --test --disable-version-check --strict --metrics=off \
--config assets/semgrep_rules/web/ \
t3sts/semgrep_rules/
shell: bash
- run: |
semgrep --test --disable-version-check --strict --metrics=off \
--config assets/semgrep_rules/c/ \
t3sts/semgrep_rules/
shell: bash
- run: |
JSON=$(semgrep \
--disable-version-check --strict --metrics=off --json \
$(find assets/semgrep_rules -name '*.yml' -or -name '*.yaml' -not -path "assets/semgrep_rules/generated/*" | sed 's/^/-c /g') \
t3sts/semgrep_rules/ || true)
ERRORS=$(echo "$JSON" | jq '.errors' || true)
BADERRS=$(echo "$ERRORS" | jq '.[] | select(.level == "error")' || true)
if [[ -n "$BADERRS" ]]; then
echo "Semgrep rule / version issue: $BADERRS"
exit 123
fi
RESULTCOUNT=$(echo "$JSON" | tr '\n' ' ' | tr '\t' ' ' | jq '.results | length')
if [[ "$RESULTCOUNT" -lt "3" ]]; then
echo "Found fewer than 3 semgrep results"
exit 122
fi
shell: bash