semgrep-self-test.yml

name: semgrep-self-test
on:
  workflow_dispatch:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    branches: [main]

jobs:
  semgrep-self-test:
    name: semgrep-self-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - run: |
          python3 -m pip --disable-pip-version-check install -r requirements.txt
        shell: bash
      - run: |
          semgrep --test --disable-version-check --strict --metrics=off \
            --config assets/semgrep_rules/web/ \
            t3sts/semgrep_rules/
        shell: bash
      - run: |
          semgrep --test --disable-version-check --strict --metrics=off \
            --config assets/semgrep_rules/c/ \
            t3sts/semgrep_rules/
        shell: bash
      - run: |
          JSON=$(semgrep \
            --disable-version-check --strict --metrics=off --json \
            $(find assets/semgrep_rules -name '*.yml' -or -name '*.yaml' -not -path "assets/semgrep_rules/generated/*" | sed 's/^/-c /g') \
            t3sts/semgrep_rules/ || true)
          ERRORS=$(echo "$JSON" | jq '.errors' || true)
          BADERRS=$(echo "$ERRORS" | jq '.[] | select(.level == "error")' || true)
          if [[ -n "$BADERRS" ]]; then
            echo "Semgrep rule / version issue: $BADERRS"
            exit 123
          fi
          RESULTCOUNT=$(echo "$JSON" | tr '\n' ' ' | tr '\t' ' ' | jq '.results | length')
          if [[ "$RESULTCOUNT" -lt "3" ]]; then
            echo "Found fewer than 3 semgrep results"
            exit 122
          fi
        shell: bash