Skip to content

Commit

Permalink
[IDP-948] Use reusable Semgrep workflow (#60)
Browse files Browse the repository at this point in the history
* [IDP-948] Use reusable Semgrep workflow

* Undo schedule and branch changes
  • Loading branch information
heqianwang authored Mar 8, 2024
1 parent 6082105 commit e5238fc
Showing 1 changed file with 2 additions and 38 deletions.
40 changes: 2 additions & 38 deletions .github/workflows/semgrep.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,43 +8,7 @@ on:
- cron: "0 9 * * 6"

jobs:
semgrep:
runs-on: ubuntu-latest
call-workflow-semgrep:
permissions:
security-events: write

container:
image: returntocorp/semgrep

steps:
- name: Checkout all commits and tags
uses: actions/checkout@v4
if: ${{ github.event_name == 'pull_request' }}
with:
fetch-depth: 0

- name: Checkout single commit
uses: actions/checkout@v4
if: ${{ github.event_name != 'pull_request' }}

- name: Pull request scan
if: ${{ github.event_name == 'pull_request' }}
run: semgrep scan --config=auto --verbose --time --error --baseline-commit ${{ github.event.pull_request.base.sha }}

- name: Full scan
if: ${{ github.event_name != 'pull_request' }}
run: semgrep scan --config=auto --verbose --time --sarif --output report.sarif

- name: Save report as pipeline artifact
if: ${{ github.event_name != 'pull_request' }}
uses: actions/upload-artifact@v4
with:
name: report.sarif
path: report.sarif

- name: Publish code scanning alerts
if: ${{ github.event_name != 'pull_request' }}
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: report.sarif
category: semgrep
uses: gsoft-inc/wl-reusable-workflows/.github/workflows/reusable-semgrep-workflow.yml@main

0 comments on commit e5238fc

Please sign in to comment.