security.yml

name: Security Analysis

on:
  push:
    branches:
      - main
      - master
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: "21 3 * * 1"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  SEMGREP_VERSION: "1.163.0"

permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  semgrep:
    name: Semgrep CE
    runs-on: ubuntu-latest
    permissions:
      actions: read
      checks: write
      contents: read
      pull-requests: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7 # v5

      - name: Cache Semgrep pip packages
        uses: actions/cache@v6 # v4
        with:
          path: ~/.cache/pip
          key: semgrep-pip-${{ runner.os }}-${{ env.SEMGREP_VERSION }}

      - name: Install Semgrep
        run: python -m pip install "semgrep==${SEMGREP_VERSION}"

      - name: Run Semgrep
        run: semgrep scan --config=auto --sarif --output=semgrep.sarif .

      - name: Validate Semgrep SARIF
        run: |
          python - <<'PY'
          import json
          from pathlib import Path

          path = Path("semgrep.sarif")
          if not path.is_file() or path.stat().st_size == 0:
              raise SystemExit("semgrep.sarif was not created or is empty")

          with path.open(encoding="utf-8") as handle:
              payload = json.load(handle)

          if payload.get("version") != "2.1.0" or not isinstance(payload.get("runs"), list):
              raise SystemExit("semgrep.sarif is not a valid SARIF 2.1.0 payload")
          PY

      - name: Setup reviewdog
        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
        uses: reviewdog/action-setup@v1 # v1.5.0
        with:
          reviewdog_version: v0.21.0

      - name: Review Semgrep diagnostics
        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          cat semgrep.sarif | reviewdog \
            -name=semgrep \
            -f=sarif \
            -reporter=github-pr-check \
            -filter-mode=diff_context \
            -level=warning || echo "reviewdog semgrep report failed" >&2

      - name: Upload Semgrep SARIF artifact
        uses: actions/upload-artifact@v7 # v7
        with:
          name: semgrep-sarif
          path: semgrep.sarif
          if-no-files-found: error

      - name: Upload Semgrep SARIF to code scanning
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
        uses: github/codeql-action/upload-sarif@v4 # v4
        with:
          sarif_file: semgrep.sarif
          category: semgrep
        continue-on-error: true