chore(ci): add semgrep

openfga · Jul 31, 2023 · 9221a54 · 9221a54
1 parent 9d1e8f5
commit 9221a54
Showing 1 changed file with 22 additions and 0 deletions.
diff --git a/.github/workflows/semgrep.yaml b/.github/workflows/semgrep.yaml
@@ -0,0 +1,22 @@
+name: Semgrep
+on:
+  push:
+    branches:
+      - main
+jobs:
+  semgrep:
+    name: Scan
+    runs-on: ubuntu-latest
+    container:
+      image: returntocorp/semgrep@sha256-742b87f61e36652e031337c2cdb03c9954a73657dac76206de1444eac3893e92 # 1.34.1
+    if: (github.actor != 'dependabot[bot]' && github.actor != 'snyk-bot')
+    steps:
+
+    - name: Checkout
+      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        fetch-depth: 0
+
+    - run: semgrep ci
+      env:
+        SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}