-
Notifications
You must be signed in to change notification settings - Fork 0
42 lines (35 loc) · 1.16 KB
/
semgrep.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
name: Semgrep
# Github Actions sintaxis help:
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
# Semgrep CI docs
# https://semgrep.dev/docs/semgrep-ci/overview/
on:
# Scan changed files in PRs, block on new issues only (existing issues ignored)
# All Branches
pull_request: {}
# Scan all files on branches, block on any issues
# All Branches
push:
# branches: ["develop", "main"]
# Schedule this job to run at a certain time, using cron syntax
# Note that * is a special character in YAML so you have to quote this string
# schedule:
# - cron: '30 0 1,15 * *' # scheduled for 00:30 UTC on both the 1st and 15th of the month
jobs:
semgrep:
name: Scan
runs-on: ubuntu-latest
container:
image: returntocorp/semgrep
# Skip any PR created by dependabot to avoid permission issues
if: (github.actor != 'dependabot[bot]')
steps:
# Fetch project source
- uses: actions/checkout@v3
- run: semgrep ci
env:
# Semgrep Rules
# https://github.com/returntocorp/semgrep-rules
SEMGREP_RULES: >-
p/security-audit
p/secrets