diff --git a/.github/workflows/semgrep.yaml b/.github/workflows/semgrep.yaml deleted file mode 100644 index f7119d88..00000000 --- a/.github/workflows/semgrep.yaml +++ /dev/null @@ -1,41 +0,0 @@ -name: Semgrep - SAST Scan - -on: - pull_request_target: - types: [edited, opened, synchronize, ready_for_review] - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true - -jobs: - semgrep: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status - runs-on: ubuntu-latest - container: - image: semgrep/semgrep:1.104.0 - - steps: - - uses: actions/checkout@v4 - with: - ref: ${{ github.event.pull_request.head.ref }} - repository: ${{ github.event.pull_request.head.repo.full_name }} - - - name: Checkout semgrep-rules repo - uses: actions/checkout@v4 - with: - repository: sourcegraph/security-semgrep-rules - token: ${{ secrets.GH_SEMGREP_SAST_TOKEN }} - path: semgrep-rules - - - name: Run Semgrep SAST Scan - run: | - mv semgrep-rules ../ - semgrep ci -f ../semgrep-rules/semgrep-rules/ --metrics=off --oss-only --suppress-errors --sarif -o results.sarif --exclude='semgrep-rules' --baseline-commit "$(git merge-base main HEAD)" || true - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: results.sarif