maxmilton/new-tab

name: semgrep
on:
  push:
    branches: [master, next]
  pull_request: {}
  workflow_dispatch: {}
  schedule:
    - cron: '28 6 * * 4'
jobs:
  analyze:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    container:
      image: returntocorp/semgrep
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - run: semgrep ci --sarif > semgrep.sarif
        env:
          SEMGREP_RULES: p/default
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: semgrep.sarif