semgrep.yaml

#
#  Author: Hari Sekhon
#  Date: Tue Feb 4 09:53:28 2020 +0000
#
#  vim:ts=2:sts=2:sw=2:et
#
#  https://github.com/HariSekhon/Terraform
#
#  If you're using my code you're welcome to connect with me on LinkedIn and optionally send me feedback
#
#  https://www.linkedin.com/in/HariSekhon
#

# ============================================================================ #
#                 S e m g r e p   G i t H u b   W o r k f l o w
# ============================================================================ #

# Generates code scanning alerts in GitHub's Security tab -> Code scanning alerts

# https://semgrep.dev/docs/semgrep-ci/sample-ci-configs/#github-actions

---
name: Semgrep

on:
  push:
    branches:
      - master
      - main
    paths-ignore:
      - '**/*.md'
  pull_request:
    branches:
      - master
      - main
    paths-ignore:
      - '**/*.md'
  workflow_dispatch:
    inputs:
      debug:
        type: boolean
        required: false
        default: false
  schedule:
    - cron: '0 0 * * 1'

permissions:
  actions: read
  contents: read
  security-events: write

concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}
  cancel-in-progress: true

jobs:
  semgrep:
    # github.event.repository context not available in scheduled workflows
    #if: github.event.repository.fork == false
    if: github.repository_owner == 'HariSekhon'
    name: Semgrep GitHub Security Tab
    uses: HariSekhon/GitHub-Actions/.github/workflows/semgrep.yaml@master
    with:
      debug: ${{ github.event.inputs.debug }}