32 lines
1.2 KiB
YAML
32 lines
1.2 KiB
YAML
# Static analysis with semgrep.
|
|
#
|
|
# Defaults to the curated p/default ruleset rather than `--config auto`, because
|
|
# auto requires sending metrics to semgrep.dev. Paths are excluded with a
|
|
# .semgrepignore in the calling repo; a single finding can be suppressed inline
|
|
# with a `nosemgrep: <rule-id>` comment.
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
config:
|
|
description: Space-separated semgrep configs (registry packs or paths in the repo).
|
|
type: string
|
|
default: p/default
|
|
|
|
jobs:
|
|
semgrep:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
- name: semgrep
|
|
env:
|
|
CONFIGS: ${{ inputs.config }}
|
|
# Both the env var and --metrics=off. Inside a job semgrep 1.90
|
|
# still prints its registry "pseudonymous rule metrics" notice;
|
|
# that could not be reproduced outside a job, so it is unexplained.
|
|
SEMGREP_SEND_METRICS: "off"
|
|
SEMGREP_ENABLE_VERSION_CHECK: "0"
|
|
run: |
|
|
semgrep --version
|
|
set -- scan --error --metrics=off --disable-version-check
|
|
for c in $CONFIGS; do set -- "$@" --config "$c"; done
|
|
semgrep "$@"
|