Skip to content

PR-4469: support drop in config schema #25

PR-4469: support drop in config schema

PR-4469: support drop in config schema #25

Workflow file for this run

name: Semgrep
on:
# Scan changed files in PRs, block on new issues only (existing issues ignored)
pull_request: {}
# Scan all files on branches, block on any issues
push:
branches: ["master", "main"]
# Schedule this job to run at a certain time, using cron syntax
# Note that * is a special character in YAML so you have to quote this string
# schedule:
# - cron: '30 0 1,15 * *' # scheduled for 00:30 UTC on both the 1st and 15th of the month
jobs:
semgrep:
name: Scan
runs-on: ubuntu-latest
container:
image: returntocorp/semgrep
# Skip any PR created by dependabot to avoid permission issues
if: (github.actor != 'dependabot[bot]')
steps:
# Fetch project source
- uses: actions/checkout@v3
- run: semgrep ci
# run: semgrep scan --sarif --output=semgrep.sarif
env:
# more rules at semgrep.dev/explore
SEMGREP_RULES: >-
p/security-audit
p/secrets
p/supply-chain
p/owasp-top-ten
p/ci
p/r2c-ci
p/docker
p/dockerfile
p/golang
p/semgrep-go-correctness
p/insecure-transport
p/javascript
p/kubernetes
p/terraform
p/swift
SEMGREP_SEND_METRICS: "off"
SEMGREP_TIMEOUT: 1800
#SEMGREP_BASELINE_REF: master
# Upload findings to GitHub Advanced Security Dashboard
# - name: Upload SARIF file for GitHub Advanced Security Dashboard
# uses: github/codeql-action/upload-sarif@v1
# with:
# sarif_file: semgrep.sarif
# if: always()