diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 74e0c7a..10aabc6 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -13,47 +13,17 @@ on: - cron: '00 03 * * 0' # scheduled for 8.30 AM on every sunday jobs: - semgrep: + central-semgrep: name: Static code Analysis - runs-on: [ self-hosted ] - - # Skip any PR created by dependabot to avoid permission issues - if: (github.actor != 'dependabot[bot]') - steps: - - name: Clean workspace - uses: navi-infra/clean-workspace@master - - # Fetch Project Source - - uses: actions/checkout@v3 - name: Checkout Source Repository - - # Fetch Semgrep Rules - - name: Fetching Semgrep Rules - uses: actions/checkout@v3 - with: - repository: Information-Security/semgrep-rules - path: semgrep-rules + uses: Information-Security/security-workflows/.github/workflows/central-semgrep.yml@master + with: + github-event-number: ${{github.event.number}} + github-event-name: ${{github.event_name}} + github-repository: ${{github.repository}} - - name: Semgrep Scan - run: | - semgrep ci -q || true && semgrep ci -q --json > semgrep.json - env: - PR_NUMBER: ${{ github.event.number }} - # Select rules for your scan with one of these two options. - # Option 1: set hard-coded rulesets - SEMGREP_RULES: >- # more at semgrep.dev/r - ./semgrep-rules - - - name: Send Vulnerablity Result(s) - if: failure() - run: /usr/bin/curl -s -X POST http://semgrep.cmd.navi-tech.in/v1/semgrep/ -H "X-repo-name":${{ github.repository }} -H "X-pr-number":${{github.event.number}} -H "X-event-name":${{ github.event_name }} -H "Content-Type:application/json" -d @semgrep.json - - - name: Send Metadata - run: /usr/bin/curl -s -X GET http://semgrep.cmd.navi-tech.in/v1/semgrep/ -H "X-repo-name":${{ github.repository }} -H "X-pr-number":${{github.event.number}} -H "X-event-name":${{ github.event_name }} -H "Content-Type:application/json" - run-if-failed: runs-on: [ self-hosted ] - needs: [semgrep] + needs: [central-semgrep] if: always() && (needs.semgrep.result == 'failure') steps: - name: Create comment