# Static analysis with semgrep.
#
# Defaults to the curated p/default ruleset rather than `--config auto`, because
# auto requires sending metrics to semgrep.dev. Paths are excluded with a
# .semgrepignore in the calling repo; a single finding can be suppressed inline
# with a `nosemgrep: <rule-id>` comment.
on:
  workflow_call:
    inputs:
      config:
        description: Space-separated semgrep configs (registry packs or paths in the repo).
        type: string
        default: p/default

jobs:
  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: semgrep
        env:
          CONFIGS: ${{ inputs.config }}
          # The env var, not --metrics=off: semgrep 1.90 still prints its
          # "reports pseudonymous rule metrics" notice for registry configs
          # when given only the flag, and does not with the env var.
          SEMGREP_SEND_METRICS: "off"
        run: |
          semgrep --version
          set -- scan --error --disable-version-check
          for c in $CONFIGS; do set -- "$@" --config "$c"; done
          semgrep "$@"