style: rewrite CheckStyle exceptions #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Semgrep SAST scan for Webswing | |
| # https://semgrep.dev/docs/semgrep-ci/sample-ci-configs | |
| # | |
| # Note: semgrep/semgrep-action is deprecated — use the semgrep Docker image directly. | |
| # | |
| # Badge (once this workflow exists): | |
| # [](https://github.com/manticore-projects/webswing/actions/workflows/semgrep.yml) | |
| name: Semgrep | |
| on: | |
| push: | |
| branches: ["master"] | |
| pull_request: | |
| branches: ["master"] | |
| # Manual trigger from the Actions tab | |
| workflow_dispatch: {} | |
| # Weekly full scan (Saturday 06:00 UTC) | |
| schedule: | |
| - cron: "0 6 * * 6" | |
| permissions: | |
| contents: read | |
| # Required for uploading SARIF to GitHub Security tab | |
| security-events: write | |
| jobs: | |
| semgrep: | |
| name: semgrep/scan | |
| runs-on: ubuntu-latest | |
| container: | |
| image: semgrep/semgrep | |
| if: github.actor != 'dependabot[bot]' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run Semgrep | |
| run: | | |
| semgrep scan \ | |
| --config p/java \ | |
| --config p/owasp-top-ten \ | |
| --config p/security-audit \ | |
| --config p/secrets \ | |
| --sarif \ | |
| --sarif-output semgrep-results.sarif \ | |
| --error \ | |
| --verbose | |
| env: | |
| # Uncomment and set in repo secrets if using Semgrep AppSec Platform: | |
| # SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} | |
| # | |
| # Restrict memory for large repos (default is 0 = unlimited) | |
| # SEMGREP_MAX_MEMORY: 4096 | |
| SEMGREP_SEND_METRICS: "off" | |
| - name: Upload SARIF to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: semgrep-results.sarif | |
| if: always() | |
| - name: Upload SARIF as artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: semgrep-results | |
| path: semgrep-results.sarif | |
| retention-days: 30 | |
| if: always() |