From 4d6e172de3d76ac79049a4cb067642ce04e23f49 Mon Sep 17 00:00:00 2001 From: Shivam Goyal Date: Mon, 15 Jan 2024 15:45:47 +0530 Subject: [PATCH] TP-54317 | Synced file(s) with navi-android/workflows (#9365) --- .github/workflows/semgrep.yml | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 897c501ce5..c788f8a432 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -1,20 +1,19 @@ name: Semgrep on: - # Scan changed files in PRs, block on new issues only (existing issues ignored) + workflow_dispatch: pull_request: - branches: + branches: - master - main - - # Schedule this job to run at a certain time, using cron syntax - # Note that * is a special character in YAML so you have to quote this string + - development + - release-* schedule: - - cron: '00 03 * * 0' # scheduled for 8.30 AM on every sunday + - cron: '30 4 * * MON' jobs: central-semgrep: - name: Static code Analysis + name: Static Code Analysis uses: navi-infosec/central-semgrep-action/.github/workflows/central-semgrep.yml@master with: github-event-number: ${{github.event.number}} @@ -22,10 +21,10 @@ jobs: github-repository: ${{github.repository}} secrets: READ_SEMGREP_RULES: ${{secrets.READ_SEMGREP_RULES}} - + run-if-failed: runs-on: [ default ] - needs: [central-semgrep] + needs: [ central-semgrep ] if: always() && (needs.semgrep.result == 'failure') steps: - name: Create comment @@ -34,8 +33,7 @@ jobs: with: issue-number: ${{ github.event.pull_request.number }} body: | - **Vulnerabilities have been discovered in this PR. Please check the vulnerability Analysis section of Semgrep Workflow to understand the security vulnerability. Feel free to reach out to #sast-help for more information ** - + **Vulnerabilities have been discovered in this PR. Please check the vulnerability Analysis section of Semgrep Workflow to understand the security vulnerability. Feel free to reach out to #sast-help for more information** - name: Assign Reviewers if: ${{ ( github.event.number != '' ) }} uses: navi-infosec/security-oncall-action@v1.1