semgrep.yml

name: semgrep

# Runs Semgrep static analysis on every push and pull request.
# Free: uses the public Semgrep registry rules, no Semgrep Cloud account and no
# token required. Findings are printed to this run's log and uploaded to the
# repository's Security > Code scanning tab as SARIF.

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read
  security-events: write   # required to upload SARIF to the Security tab

jobs:
  semgrep:
    name: scan
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: Run Semgrep (human-readable summary in this log)
        # --config auto pulls the registry's recommended rules for the detected
        # languages; p/gitleaks adds secret detection. Findings print to this
        # log. We do not fail the build: the gate appends results for triage
        # instead of blocking (see the "Make the gate usable" idea).
        # --config auto sends anonymous rule-match metrics to the registry; that
        # is the documented no-account behavior and is required for "auto".
        run: |
          semgrep scan \
            --config auto \
            --config p/gitleaks
        continue-on-error: true

      - name: Run Semgrep (SARIF for the Security tab)
        run: |
          semgrep scan \
            --config auto \
            --config p/gitleaks \
            --sarif --output semgrep.sarif
        continue-on-error: true

      - name: Upload SARIF to the Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: semgrep.sarif