Trying semgrep in actions

pirxthepilot · Dec 5, 2022 · 4647b68 · 4647b68
1 parent b943c46
commit 4647b68
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -49,3 +49,18 @@ jobs:
 
     - name: Run tests
       run: hatch run test-all
+
+  semgrep:
+    name: Semgrep Scan
+    runs-on: ubuntu-latest
+    container:
+      image: returntocorp/semgrep
+
+    # Skip any PR created by dependabot to avoid permission issues:
+    if: (github.actor != 'dependabot[bot]')
+
+    steps:
+      - uses: actions/checkout@v3
+      - run: semgrep ci
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}