semgrep.yml

name: Semgrep

on:
    # Scan changed files in PRs (diff-aware scanning):
    pull_request: {}
    push:
      branches:
        - main
    # On-demand 
    workflow_dispatch: {}

jobs:
  semgrep:
    # User-definable name of this GitHub Actions job:
    name: Scan
    runs-on: ubuntu-latest

    container:
      # A Docker image with Semgrep installed. Do not change this.
      image: returntocorp/semgrep

    # Skip any PR created by dependabot to avoid permission issues:
    if: (github.actor != 'dependabot[bot]')

    steps:
      # Fetch project source with GitHub Actions Checkout.
      - uses: actions/checkout@v3
      # Fetch semgrep rules
      - name: Fetch semgrep rules
        uses: actions/checkout@v3
        with:
          repository: decurity/semgrep-smart-contracts
          path: rules
      # Upgrade semgrep
      - run: pip install semgrep --upgrade
      # Run security and gas optimization rules
      - run: semgrep ci --sarif --output=semgrep.sarif --exclude-rule rules.solidity.performance.unnecessary-checked-arithmetic-in-loop || true
        env:
             SEMGREP_RULES: rules/solidity/security rules/solidity/performance
      # Upload findings to GitHub Advanced Security Dashboard
      - name: Upload findings to GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: semgrep.sarif
        if: always()