semgrep-analysis.yml

# See https://semgrep.dev/docs
---

name: Semgrep

on:
  push:
    branches: [master, ros2]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [master]
  schedule:
    - cron: '39 7 * * 4'

jobs:
  semgrep:
    name: Scan
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep

    # Skip any PR created by dependabot to avoid permission issues:
    if: (github.actor != 'dependabot[bot]')

    steps:
      - uses: actions/checkout@v3
      - run: semgrep ci
        env:
          SEMGREP_RULES: p/default