semprep.yaml

name: Semgrep static analysis
on:
  push:
  pull_request:
    types:
      - edited
      - opened
      - ready_for_review
      - synchronize
      - reopened
  merge_group:
    types: [checks_requested]
jobs:
  semgrep:
    permissions:
      contents: read
    # User definable name of this GitHub Actions job.
    name: semgrep-oss/scan
    # If you are self-hosting, change the following `runs-on` value:
    runs-on: ubuntu-latest
    container:
      # A Docker image with Semgrep installed. Do not change this.
      image: semgrep/semgrep:1.152.0
    steps:
      # Fetch project source with GitHub Actions Checkout.
      - uses: actions/checkout@v4

      # Fetch org-wide custom Semgrep rules from the central repository.
      - uses: actions/checkout@v4
        with:
          repository: grafana/security-github-actions
          path: .semgrep-org-rules
          sparse-checkout: sempgrep/custom-rules.yaml

      # Run semgrep with: auto rules + org-wide shared rules
      - run: semgrep scan --config auto --config .semgrep-org-rules/.semgrep/