Github: Add Semgrep Check On Pull Request (#3429)

* Initial version of semgrep diff * Update semgrep_diff.yml * reformat params * Pin checkout action to sha * Dummy - To Test Semgrep * Testing SEMGREP * Ignore Nagios Example j2 templates --------- Co-authored-by: Martijn Verburg <[email protected]>
adoptium · Mar 5, 2024 · b6cd869 · b6cd869
1 parent d80c1c8
commit b6cd869
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/.github/workflows/semgrep_diff.yml b/.github/workflows/semgrep_diff.yml
@@ -0,0 +1,23 @@
+---
+name: Semgrep Differential Scan
+on:
+  pull_request:
+
+jobs:
+  semgrep-diff:
+    runs-on: ubuntu-latest
+    container:
+      image: returntocorp/semgrep
+
+    steps:
+      # Step 1: Clone application source code
+      - name: Checkout code
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
+        with:
+          fetch-depth: 0
+
+      # Step 2: Differential scan
+      - name: Differential scan
+        run: |
+          semgrep scan --error --metrics=off --config="p/trailofbits" \
+            --baseline-commit ${{ github.event.before }}
diff --git a/.semgrepignore b/.semgrepignore
@@ -0,0 +1,2 @@
+# Ignore The Nagios Configuration J2 templates, as they are only examples.
+./ansible/playbooks/nagios/roles/Nagios_Config/files/templates/*.j2
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		# Ignore The Nagios Configuration J2 templates, as they are only examples.
		./ansible/playbooks/nagios/roles/Nagios_Config/files/templates/*.j2