build(deps): bump @aws-sdk/client-bedrock-runtime from 3.1045.0 to 3.1050.0 #132

	name: Semgrep

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: "20 17 * * 1"

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	# Top-level least-privilege; the semgrep job opts into security-events:write
	# explicitly so the SARIF upload step can post results. (Scorecard Token-Permissions)
	permissions:
	contents: read

	jobs:
	semgrep:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	container:
	image: semgrep/semgrep
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
	- name: semgrep scan (p/auto + p/owasp-top-ten)
	# `\|\| true` so the SARIF upload step still runs on findings;
	# gating happens through GitHub code scanning, not the scan's
	# exit code. `returntocorp/semgrep` is the deprecated legacy
	# image (the org renamed to `semgrep/`), and `semgrep ci`
	# rejects --config flags — so we invoke `semgrep scan` directly.
	run: \|
	semgrep scan \
	--config p/auto \
	--config p/owasp-top-ten \
	--sarif --output=semgrep.sarif \
	--metrics=off \|\| true
	- uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
	if: always()
	with:
	sarif_file: semgrep.sarif
	category: semgrep

Navigation Menu