semgrep.yml

on:
  pull_request:
    branches: [master]

  push:
    branches:
    - main
    - master

  schedule:
  - cron: '0 0 * * 0'
  workflow_dispatch:
    inputs:
      reason:
        description: "The reason for running the workflow"
        required: true
        default: "Manual run"
name: Semgrep
jobs:
  semgrep:
    name: Semgrep/CI
    runs-on: ubuntu-latest
    env:
      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
    container:
      image: returntocorp/semgrep
      # https://github.com/actions/runner/issues/2033#issuecomment-1598547465
      options: --user 1001
    steps:
    - name: 'Checkout Repository'
      uses: actions/checkout@v4.2.2
    - name: "Check for changed files"
      uses: dorny/paths-filter@v3
      id: filter
      with:
        filters: .github/filter.yml


    - name: 'Run Semgrep'
      if: steps.filter.outputs.code == 'true' || steps.filter.outputs.semgrep == 'true'
      run: semgrep ci