Repository navigation
add Semgrep SAST and secrets scan workflow - #19
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1,5 @@ | |||
| # Copyright (c) 2026 Intel Corporation | |||
There was a problem hiding this comment.
can we move this file e.g. to within .github dir? or some of its subdir?
There was a problem hiding this comment.
no, it has to be here
There was a problem hiding this comment.
why?
-f VAL, -c VAL, --config=VAL (absent SEMGREP_RULES env)
YAML configuration file, directory of YAML files ending in
.yml|.yaml, URL of a configuration file, or Semgrep registry entry
name.
ref. https://docs.semgrep.dev/cli-reference
can you please move it into .github dir?
There was a problem hiding this comment.
https://docs.semgrep.dev/semgrep-appsec-platform/tags#set-tags-in-semgrepconfig-yml
it has to be in root directory
There was a problem hiding this comment.
hmm.. I know it says "create in the root dir", but did you try it to configure it elsewhere?
tbh, I don't like extra yml file in the root dir, just for the sake of one CI workflow... If it's really not working, then ok, but please check if you haven't yet.
There was a problem hiding this comment.
I have moved to .github and looks good for now
There was a problem hiding this comment.
yaay, perfect, thanks
|
When ready please make use of the commit convention (committed in our repo) and also update the PR title accordingly. Also you have to add a signoff to your commit. |
| @@ -0,0 +1,5 @@ | |||
| # Copyright (c) 2026 Intel Corporation | |||
There was a problem hiding this comment.
why?
-f VAL, -c VAL, --config=VAL (absent SEMGREP_RULES env)
YAML configuration file, directory of YAML files ending in
.yml|.yaml, URL of a configuration file, or Semgrep registry entry
name.
ref. https://docs.semgrep.dev/cli-reference
can you please move it into .github dir?
3f9760a to
00f3e40
Compare
Add a Semgrep CI workflow that runs code (SAST) and secrets scanning on pull requests, workflow_dispatch, and push to the main branch. The job runs on the semgrep/semgrep container, checks out the repository. Signed-off-by: Renata Banka <renata.banka@intel.com>
4 participants
Add a Semgrep CI workflow that runs code (SAST) and secrets scanning on pull requests, workflow_dispatch, and push to the main branch. The job runs on the semgrep/semgrep container, checks out the repository.