sast.yaml

# This repository is public and cannot call reusable workflows from a private
# repository (regulaforensics/reusable-workflows). The logic below is a local
# copy that mirrors the reusable workflow exactly. SHA pins are kept up-to-date
# by Renovate (see renovate.json).
name: SAST

on:
  pull_request:
    branches:
      - develop
      - staging
      - production
      - stable
      - main
      - master

jobs:
  semgrep:
    name: semgrep-oss/scan
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep@sha256:acaac22ffc7b7cc5926de0751b223bce0b2491c33d18422fa72f632c78d81198
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Scan
        shell: bash
        env:
          EXCLUDE_PATHS: 'client/generator-templates client/src/main/generated .github'
          EXCLUDE_RULES: ''
        run: |
          EXCLUDED_PATHS=()
          if [[ -n "$EXCLUDE_PATHS" ]]; then
            for path in $EXCLUDE_PATHS; do
              EXCLUDED_PATHS+=("--exclude" "$path")
            done
          fi

          EXCLUDED_RULES=()
          if [[ -n "$EXCLUDE_RULES" ]]; then
            for rule in $EXCLUDE_RULES; do
              EXCLUDED_RULES+=("--exclude-rule" "$rule")
            done
          fi

          semgrep scan --config auto "${EXCLUDED_PATHS[@]}" "${EXCLUDED_RULES[@]}" --error --verbose