name: Semgrep SAST

on:
  push:
    branches: ["master"]
  pull_request:
  schedule:
    - cron: '0 6 * * 1'
  workflow_dispatch:

permissions:
  security-events: write
  contents: read

jobs:
  semgrep:
    name: Semgrep scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install Semgrep
        run: pip install semgrep

      - name: Run Semgrep
        run: |
          semgrep scan --config p/javascript --config p/react --config p/security-audit --config p/secrets \
            --sarif --output semgrep.sarif \
            --error || true

      - name: Upload SARIF to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: semgrep.sarif