semgrep_diff.yml

# ********************************************************************************
# Copyright (c) 2024 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made
# available under the terms of the Apache Software License 2.0
# which is available at https://www.apache.org/licenses/LICENSE-2.0.
#
# SPDX-License-Identifier: Apache-2.0
# ********************************************************************************

---
name: Semgrep Differential Scan
on:
  workflow_call:

permissions:
  contents: read
  statuses: write

jobs:
  semgrep-diff:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep:latest

    steps:
      # Step 1: Clone application source code
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      # Step 2: Differential scan
      - name: Differential scan
        run: |
          semgrep ci \
            --config="p/trailofbits"