Skip to content

chore(deps): update dependency semgrep to ~=1.97.0 #2092

chore(deps): update dependency semgrep to ~=1.97.0

chore(deps): update dependency semgrep to ~=1.97.0 #2092

name: semgrep-self-test
on:
workflow_dispatch:
push:
branches: [main]
pull_request:
types: [opened, synchronize, reopened, ready_for_review]
branches: [main]
permissions:
# This is a public repo, no permissions required to clone
contents: none
jobs:
semgrep-self-test:
name: semgrep-self-test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- run: |
python3 -m pip --disable-pip-version-check install -r requirements.txt
shell: bash
- run: |
cd assets/semgrep_rules/; semgrep --test --disable-version-check --strict --metrics=off
shell: bash
- run: |
JSON=$(semgrep \
--disable-version-check --strict --metrics=off --json \
$(find assets/semgrep_rules -name '*.yml' -or -name '*.yaml' -not -name '*.test.yml' -not -name '*.test.yaml' -not -path "assets/semgrep_rules/generated/*" | sed 's/^/-c /g') \
assets/semgrep_rules/{client,services} || true)
ERRORS=$(echo "$JSON" | jq '.errors' || true)
BADERRS=$(echo "$ERRORS" | jq '.[] | select(.level == "error")' || true)
if [[ -n "$BADERRS" ]]; then
echo "Semgrep rule / version issue: $BADERRS"
exit 123
fi
RESULTCOUNT=$(echo "$JSON" | tr '\n' ' ' | tr '\t' ' ' | jq '.results | length')
NUMRESULTS=$(grep -R ruleid: | wc -l)
if [[ "$RESULTCOUNT" -lt "$NUMRESULTS" ]]; then
echo "Found fewer than $NUMRESULTS semgrep results"
exit 122
fi
shell: bash