# Static analysis with semgrep.
#
# Defaults to the curated p/default ruleset rather than `--config auto`, because
# auto requires sending metrics to semgrep.dev. Paths are excluded with a
# .semgrepignore in the calling repo; a single finding can be suppressed inline
# with a `nosemgrep: <rule-id>` comment.
on:
  workflow_call:
    inputs:
      config:
        description: Space-separated semgrep configs (registry packs or paths in the repo).
        type: string
        default: p/default

jobs:
  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: semgrep
        env:
          CONFIGS: ${{ inputs.config }}
          # Both the env var and --metrics=off. Inside a job semgrep 1.90
          # still prints its registry "pseudonymous rule metrics" notice;
          # that could not be reproduced outside a job, so it is unexplained.
          SEMGREP_SEND_METRICS: "off"
          SEMGREP_ENABLE_VERSION_CHECK: "0"
        run: |
          semgrep --version
          set -- scan --error --metrics=off --disable-version-check
          for c in $CONFIGS; do set -- "$@" --config "$c"; done
          semgrep "$@"