semgrep.yml

# Software Name: OUDS Flutter
# SPDX-FileCopyrightText: Copyright (c) Orange SA
# SPDX-License-Identifier: MIT
#
# This software is distributed under the MIT license,
# the text of which is available at https://opensource.org/license/MIT/
# or see the "LICENSE" file for more details.
#
# Software description: Flutter library of reusable graphical components

name: Semgrep - SAST Analysis

on:
  push:
    branches:
      - main
      - develop
  pull_request:
    branches:
      - main
      - develop
  schedule:
    - cron: '0 1 * * 1'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  semgrep:
    name: Semgrep SAST Scan
    runs-on: ubuntu-latest

    permissions:
      contents: read
      security-events: write

    container:
      image: semgrep/semgrep

    if: (github.actor != 'dependabot[bot]')

    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Run Semgrep
        run: |
          semgrep ci \
            --sarif \
            --output semgrep.sarif \
            --config auto \
            --exclude "build/" \
            --exclude ".dart_tool/" \
            --exclude "*.g.dart" \
            --exclude "*.freezed.dart"
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
        continue-on-error: true

      - name: Upload Semgrep SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
        with:
          sarif_file: semgrep.sarif
        if: always()