31 lines
1.1 KiB
YAML
31 lines
1.1 KiB
YAML
# Static analysis with semgrep.
|
|
#
|
|
# Defaults to the curated p/default ruleset rather than `--config auto`, because
|
|
# auto requires sending metrics to semgrep.dev. Paths are excluded with a
|
|
# .semgrepignore in the calling repo; a single finding can be suppressed inline
|
|
# with a `nosemgrep: <rule-id>` comment.
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
config:
|
|
description: Space-separated semgrep configs (registry packs or paths in the repo).
|
|
type: string
|
|
default: p/default
|
|
|
|
jobs:
|
|
semgrep:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: semgrep
|
|
env:
|
|
CONFIGS: ${{ inputs.config }}
|
|
# The env var, not --metrics=off: semgrep 1.90 still prints its
|
|
# "reports pseudonymous rule metrics" notice for registry configs
|
|
# when given only the flag, and does not with the env var.
|
|
SEMGREP_SEND_METRICS: "off"
|
|
run: |
|
|
semgrep --version
|
|
set -- scan --error --disable-version-check
|
|
for c in $CONFIGS; do set -- "$@" --config "$c"; done
|
|
semgrep "$@"
|