semgrep_scan.yml

# doc https://semgrep.dev/docs/semgrep-ci/sample-ci-configs/#sample-github-actions-configuration-file
name: Semgrep Scan

on:
  workflow_call:
    inputs:
      verbose:
        description: verbose mode
        type: boolean
        default: false
  workflow_dispatch:
    inputs:
      verbose:
        description: verbose mode
        type: boolean
        default: false

jobs:
  semgrep:
    name: Semgrep
    runs-on: ubuntu-latest
    # dependency scan is out of scope for semgrep
    if: github.actor != 'dependabot[bot]'

    container:
      # A Docker image with Semgrep installed. Do not change this.
      image: returntocorp/semgrep

    steps:
      # Fetch project source with GitHub Actions Checkout.
      - uses: actions/checkout@v4
      # Run the "semgrep ci" command on the command line of the docker image.
      - name: Setup scan option
        run: |
          [[ "${{ inputs.verbose }}" == "true" ]] && export VERBOSE=--verbose || export VERBOSE=''
          echo "VERBOSE_OPTION=$VERBOSE" >> $GITHUB_ENV
      - name: Scan
        run: |
          semgrep ci --no-suppress-errors ${{ env.VERBOSE_OPTION }}
          BBlue='\033[1;34m'
          Color_Reset='\033[0m'
          echo ""; echo -e "📝 ${BBlue}View results ${{ github.repository }} in Semgrep Cloud Platform:${Color_Reset}"
          echo "  https://semgrep.dev/orgs/-/findings?repo=Refinitiv%2Frefinitiv-ui"
        env:
          # Connect to Semgrep Cloud Platform through your SEMGREP_APP_TOKEN.
          # Generate a token from Semgrep Cloud Platform > Settings
          # and add it to your GitHub secrets.
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}