Semgrep #17

	# This workflow uses actions that are not certified by GitHub.
	# They are provided by a third-party and are governed by
	# separate terms of service, privacy policy, and support
	# documentation.

	# This workflow file requires a free account on Semgrep.dev to
	# manage rules, file ignores, notifications, and more.
	#
	# See https://semgrep.dev/docs

	name: Semgrep

	on:
	push:
	branches: [ "master", "main" ]
	pull_request:
	# The branches below must be a subset of the branches above
	branches: [ "master", "main" ]
	schedule:
	- cron: '39 6 * * 1'


	jobs:
	semgrep:
	# User-definable name of this GitHub Actions job:
	name: Scan
	# If you are self-hosting, change the following `runs-on` value:
	runs-on: ubuntu-latest
	container:
	# A Docker image with Semgrep installed. Do not change this.
	image: returntocorp/semgrep

	# Skip any PR created by dependabot to avoid permission issues:
	if: (github.actor != 'dependabot[bot]')

	# Prevent blocking Pull requests and commits.
	continue-on-error: true

	steps:
	# Fetch project source with GitHub Actions Checkout.
	- uses: actions/checkout@v3
	# Run the "semgrep ci" command on the command line of the docker image.
	- run: semgrep ci --sarif --output=semgrep.sarif
	env:
	# Add the rules that Semgrep uses by setting the SEMGREP_RULES environment variable.
	SEMGREP_RULES: p/owasp-top-ten # more at semgrep.dev/explore

	- name: Upload SARIF file for GitHub Advanced Security Dashboard
	uses: github/codeql-action/upload-sarif@v2
	with:
	sarif_file: semgrep.sarif
	if: always()

Provide feedback