sast.yml

name: SAST

on:
  workflow_call:
    inputs:
      environment:
        type: string
        default: ''
      runs-on:
        type: string
        default: 'ubuntu-latest'
      upload-sarif:
        type: boolean
        default: true
    secrets:
      semgrep_app_token:
        required: false

jobs:
  semgrep:
    permissions:
      contents: read
      pull-requests: write
      security-events: write
    name: Semgrep
    runs-on: ${{ inputs.runs-on }}
    environment: ${{ inputs.environment != '' && inputs.environment || null }}
    if: (github.repository_owner == 'notdodo')
    container:
      image: semgrep/semgrep:1.159.0
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: 'Dependency Review'
        if: github.event_name == 'pull_request' && inputs.upload-sarif
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          fail-on-severity: moderate
          comment-summary-in-pr: on-failure
      - name: Semgrep
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.semgrep_app_token }}
        run: |
          if [ -n "$SEMGREP_APP_TOKEN" ]; then
            echo "Running authenticated scan..."
            semgrep ci --sarif --sarif-output=./sast-output.sarif
          else
            echo "Running default scan..."
            semgrep scan --config=auto --sarif --sarif-output=./sast-output.sarif
          fi
      - uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0
      - name: Run reviewdog
        continue-on-error: true
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo -n "$(cat ./sast-output.sarif)" | reviewdog -reporter=github-check -f=sarif -level=error -diff="git diff FETCH_HEAD"
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa #  v4.36.0
        with:
          sarif_file: ./sast-output.sarif
          category: sast
        if: ${{ inputs.upload-sarif }}