semgrep.yml

name: Semgrep
on:
  workflow_dispatch: {}
  pull_request: {}
  push:
    branches:
      - main
  schedule:
    # random HH:MM to avoid a load spike on GitHub Actions at 00:00
    - cron: '56 22 * * *'
jobs:
  semgrep:
    name: semgrep/ci
    runs-on: ubuntu-20.04
    env:
      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
    container:
      image: semgrep/semgrep
        
    if: (github.actor != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@v4    
      - name: Checkout semgrep-utilities repo
        uses: actions/checkout@v4
        with:
          repository: zeta-chain/semgrep-utilities
          path: semgrep-utilities
          
      - run: semgrep ci --json --output semgrep-findings.json 
      
      - run: python semgrep-utilities/utilities/github-sarif-helper/src/semgrep-json-to-sarif.py --json semgrep-findings.json --sarif semgrep-github.sarif

      - name: Upload SARIF file for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep-github.sarif