semgrep.yml

# Software Name: OUDS Flutter
# SPDX-FileCopyrightText: Copyright (c) Orange SA
# SPDX-License-Identifier: MIT
#
# This software is distributed under the MIT license,
# the text of which is available at https://opensource.org/license/MIT/
# or see the "LICENSE" file for more details.
#
# Software description: Flutter library of reusable graphical components

name: Semgrep - Security Pattern Analysis

on:
  push:
  pull_request:
  schedule:
    - cron: '0 1 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  semgrep:
    name: Scan for vulnerabilities with Semgrep
    runs-on: ubuntu-latest
    timeout-minutes: 60

    permissions:
      contents: read
      security-events: write

    container:
      image: semgrep/semgrep:latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Run Semgrep SAST Analysis
        run: |
          semgrep scan \
            --sarif \
            --output semgrep.sarif \
            --config auto \
            --exclude "build/" \
            --exclude ".dart_tool/" \
            --exclude "*.g.dart" \
            --exclude "*.freezed.dart" \
            --exclude "test/" \
            --exclude ".github/" \
            .
        continue-on-error: true

      - name: Check SARIF file
        run: |
          if [ -f semgrep.sarif ]; then
            echo "✅ SARIF generated: $(du -sh semgrep.sarif)"
          else
            echo "⚠️ SARIF not found, creating empty SARIF..."
            echo '{"version":"2.1.0","runs":[{"tool":{"driver":{"name":"Semgrep","rules":[]}},"results":[]}]}' > semgrep.sarif
          fi

      - name: Upload Semgrep SARIF
        uses: github/codeql-action/upload-sarif@b0565cb28b456da32509aef995361ffcc63f40b0 # v3.28.15
        with:
          sarif_file: semgrep.sarif
          category: semgrep-security
        if: always()

      - name: Report Summary
        if: always()
        run: |
          echo "✅ Semgrep security analysis complete"
          echo "📊 Results available in GitHub Security Dashboard"