Added semgrep workflow #2
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Semgrep SAST Scan | |
| on: | |
| pull_request: | |
| jobs: | |
| semgrep: | |
| # User definable name of this GitHub Actions job. | |
| name: semgrep/ci | |
| # If you are self-hosting, change the following `runs-on` value: | |
| runs-on: ubuntu-latest | |
| container: | |
| # A Docker image with Semgrep installed. Do not change this. | |
| image: returntocorp/semgrep | |
| # Skip any PR created by dependabot to avoid permission issues: | |
| if: (github.actor != 'dependabot[bot]') | |
| permissions: | |
| # required for all workflows | |
| security-events: write | |
| # only required for workflows in private repositories | |
| actions: read | |
| contents: read | |
| steps: | |
| # Fetch project source with GitHub Actions Checkout. | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Perform Semgrep Analysis | |
| # @NOTE: This is the actual semgrep command to scan your code. | |
| # Modify the --config option to 'r/all' to scan using all rules, | |
| # or use multiple flags to specify particular rules, such as | |
| # --config r/all --config custom/rules | |
| run: semgrep scan -q --sarif --config auto --config "p/secrets" . > semgrep-results.sarif | |
| - name: Pretty-Print SARIF Output | |
| run: | | |
| jq . semgrep-results.sarif > formatted-semgrep-results.sarif || echo "{}" | |
| echo "Formatted SARIF Output (First 20 lines):" | |
| head -n 20 formatted-semgrep-results.sarif || echo "{}" | |
| - name: Validate JSON Output | |
| run: | | |
| if ! jq empty formatted-semgrep-results.sarif > /dev/null 2>&1; then | |
| echo "⚠️ Semgrep output is not valid JSON. Skipping annotations." | |
| exit 0 | |
| fi | |
| - name: Add PR Annotations for Semgrep Findings | |
| run: | | |
| total_issues=$(jq '.runs[0].results | length' formatted-semgrep-results.sarif) | |
| if [[ "$total_issues" -eq 0 ]]; then | |
| echo "✅ No Semgrep issues found!" | |
| exit 0 | |
| fi | |
| jq -c '.runs[0].results[]' formatted-semgrep-results.sarif | while IFS= read -r issue; do | |
| file=$(echo "$issue" | jq -r '.locations[0].physicalLocation.artifactLocation.uri') | |
| line=$(echo "$issue" | jq -r '.locations[0].physicalLocation.region.startLine') | |
| message=$(echo "$issue" | jq -r '.message.text') | |
| if [[ -n "$file" && -n "$line" && -n "$message" ]]; then | |
| echo "::error file=$file,line=$line,title=Semgrep Issue::${message}" | |
| fi | |
| done |