semgrep.yml

name: Semgrep

on:
    # Scan changed files in PRs (diff-aware scanning):
    pull_request: {}
    # Scan on-demand through GitHub Actions interface:
    workflow_dispatch:
        inputs:
            branch:
                description: "The branch to run against the semgrep tool"
                required: true
    push:
        branches:
            - main
            - release-*
            - v*
    # Schedule the CI job (this method uses cron syntax):
    schedule:
        - cron: "0 8 * * *" # Sets Semgrep to scan every day at 08:00 UTC.

jobs:
    semgrep:
        # User definable name of this GitHub Actions job.
        name: semgrep/ci
        # If you are self-hosting, change the following `runs-on` value:
        runs-on: ubuntu-latest

        container:
            # A Docker image with Semgrep installed. Do not change this.
            image: semgrep/semgrep

        # Skip any PR created by dependabot to avoid permission issues:
        if: (github.actor != 'dependabot[bot]')

        steps:
            # Fetch project source with GitHub Actions Checkout.
            - uses: actions/checkout@v4
            # Run the "semgrep ci" command on the command line of the docker image.
            - run: semgrep ci --config auto --no-suppress-errors --exclude-rule generic.secrets.security.detected-private-key.detected-private-key