semgrep-analysis.yaml

name: Semgrep

on:  # yamllint disable-line rule:truthy
  push:
    branches: [master, main, '*.*', 'staging*']
  pull_request:
    branches: [master, main, '*.*', 'staging*']

jobs:
  semgrep:
    name: Semgrep Scan
    runs-on: ubuntu-latest
    steps:
    # Checkout project source
    - uses: actions/checkout@v2

    # Scan code using project's configuration on https://semgrep.dev/manage
    - uses: returntocorp/semgrep-action@v1
      with:
        # publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}
        # publishDeployment: ${{ secrets.SEMGREP_DEPLOYMENT_ID }}
        # generateSarif: '1'
        config: >-
          p/ci
          p/clientside-js
          p/command-injection
          p/eslint-plugin-security
          p/gitlab-eslint
          p/insecure-transport
          p/javascript
          p/owasp-top-ten
          p/r2c
          p/r2c-best-practices
          p/r2c-bug-scan
          p/r2c-ci
          p/security-audit
          p/secrets

      # Upload SARIF file generated in previous step
      # - name: Upload SARIF file
      #   uses: github/codeql-action/upload-sarif@v1
      #   with:
      #     sarif_file: semgrep.sarif
      #   if: always()