chore(deps): aggregate weekly Dependabot batch (api, ui, docs, ci) #399
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: security-sast | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "apps/ui/**" | |
| - ".github/workflows/apps-ui-security-sast.yml" | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "29 6 * * 1" | |
| concurrency: | |
| group: apps-ui-security-sast-security-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| security-events: write | |
| pull-requests: read | |
| jobs: | |
| semgrep: | |
| name: semgrep SAST | |
| defaults: | |
| run: | |
| working-directory: apps/ui | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| container: | |
| image: semgrep/semgrep:1.142.0@sha256:03402a5040a88a570dec58375ef1a19fa777dd61575afdc7d5527ddf308dd765 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| # The semgrep container runs as root, while the runner-prepared | |
| # workspace is owned by the runner user (uid != 0). Subsequent git | |
| # invocations (post-checkout cleanup, semgrep's --baseline-commit | |
| # diffing) bail out with `fatal: detected dubious ownership in | |
| # repository` unless we trust the workspace path explicitly. | |
| # Override working-directory because the job default (`apps/ui`) | |
| # is a child of the workspace. | |
| - name: Trust the runner-prepared workspace | |
| working-directory: ${{ github.workspace }} | |
| run: git config --global --add safe.directory '*' | |
| - name: Detect relevant changes | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| id: filter | |
| with: | |
| filters: | | |
| code: | |
| - 'apps/ui/**' | |
| - '.github/workflows/apps-ui-security-sast.yml' | |
| - name: Compute baseline | |
| if: steps.filter.outputs.code == 'true' | |
| id: baseline | |
| run: | | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| echo "ref=${{ github.event.pull_request.base.sha }}" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "ref=" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Run semgrep | |
| if: steps.filter.outputs.code == 'true' | |
| shell: bash | |
| run: | | |
| BASELINE="${{ steps.baseline.outputs.ref }}" | |
| ARGS=( | |
| scan | |
| --config=p/owasp-top-ten | |
| --config=p/javascript | |
| --config=p/typescript | |
| --config=p/react | |
| --config=.semgrep/ui.yml | |
| --sarif --output=semgrep-results.sarif | |
| --error | |
| ) | |
| if [ -n "$BASELINE" ]; then | |
| ARGS+=(--baseline-commit="$BASELINE") | |
| fi | |
| semgrep "${ARGS[@]}" | |
| - name: Upload semgrep SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4 | |
| with: | |
| sarif_file: semgrep-results.sarif | |
| category: semgrep-ui | |
| continue-on-error: true |