Move rules to runner.temp

Author: NyanKiyoshi

.github/workflows/action-run-semgrep.yaml

@@ -57,8 +57,8 @@ env:
     auto
     p/ci
     r/yaml.github-actions
-    /opt/saleor-rules/yaml
-    /opt/saleor-rules/typescript
+    ${{ runner.temp }}/saleor-rules/yaml
+    ${{ runner.temp }}/saleor-rules/typescript
   # yaml.github-actions.[...].run-shell-injection is duplicate of saleor-rules.yaml.github-actions.script-injection
   DEFAULT_EXCLUDE_RULE_IDS: |
     yaml.github-actions.security.run-shell-injection.run-shell-injection
@@ -102,7 +102,9 @@ jobs:
           # Note: the directory name will be used for rule IDs
           # (e.g., saleor-rules.typescript.my-check).
           # Thus avoid changing the path and ensure the name is meaningful.
-          path: /opt/saleor-rules
+          # NOTE: this needs to be outside ./ otherwise Semgrep will scan that folder
+          #       as well.
+          path: ${{ runner.temp }}/saleor-rules
           set-safe-directory: false
 
       - name: Run Semgrep Rules