This repository was archived by the owner on Jun 7, 2026. It is now read-only.
Fix/pagination #223
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Semgrep Security Scan | |
| # Replaces CodeQL. Runs the same trigger paths; outputs SARIF to the | |
| # GitHub Security tab. Uses the OSS ruleset (no token required). | |
| # Optionally set SEMGREP_APP_TOKEN secret for Semgrep AppSec Platform | |
| # features (triage, policies, custom rules). | |
| # | |
| # Known false positives (previously suppressed in .github/codeql/codeql-config.yml): | |
| # - [0u8; 32] zero-init buffers immediately filled by a CSPRNG — not hard-coded secrets | |
| # - Test fixture passwords inside #[cfg(test)] blocks — intentional, non-production values | |
| # If Semgrep surfaces these, suppress with a `# nosemgrep` comment on the relevant line. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - '**.rs' | |
| - '**.toml' | |
| - '**.py' | |
| - '**.ts' | |
| - '**.tsx' | |
| - '**.js' | |
| - '**.jsx' | |
| - '.github/workflows/semgrep.yml' | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - '**.rs' | |
| - '**.toml' | |
| - '**.py' | |
| - '**.ts' | |
| - '**.tsx' | |
| - '**.js' | |
| - '**.jsx' | |
| - '.github/workflows/semgrep.yml' | |
| schedule: | |
| - cron: '0 3 * * 1' # Weekly Monday 3am UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| semgrep: | |
| name: Semgrep | |
| runs-on: ubuntu-latest | |
| container: | |
| image: semgrep/semgrep | |
| if: github.actor != 'dependabot[bot]' | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Run Semgrep (OSS) | |
| # semgrep scan runs the OSS engine with no token required. | |
| # If SEMGREP_APP_TOKEN is set, results are also sent to the platform. | |
| # continue-on-error so SARIF upload still runs even when findings exist. | |
| run: | | |
| if [ -n "$SEMGREP_APP_TOKEN" ]; then | |
| semgrep ci --sarif --output semgrep.sarif | |
| else | |
| semgrep scan --sarif --output semgrep.sarif --config auto . | |
| fi | |
| env: | |
| SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} | |
| continue-on-error: true | |
| - name: Upload SARIF to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: semgrep.sarif |