semgrep.yml

name: Semgrep
on:
  # Scan changed files in PRs, block on new issues only (existing issues ignored)
  pull_request:

permissions: read-all

jobs:
  # Update from: https://semgrep.dev/docs/semgrep-ci/sample-ci-configs/#github-actions [removing GH Security Dashboard]
  semgrep:
    name: Scan
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep
    if: (github.actor != 'dependabot[bot]')
    steps:
      - name: Permission issue fix
        run: git config --global --add safe.directory /__w/evmos/evmos
      - uses: actions/checkout@v4
      - name: Get Diff
        uses: technote-space/get-diff-action@v6.1.2
        with:
          PATTERNS: |
            **/*.go
            **/*.js
            **/*.ts
            **/*.sol
            go.mod
            go.sum
            *.toml
      - uses: actions/checkout@v4
      - run: semgrep ci --config=auto
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
        if: "env.GIT_DIFF_FILTERED != ''"