semgrep.yml

name: Semgrep

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "19 4 * * 4"

permissions: read-all

jobs:
  analysis:
    name: Semgrep Analysis
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write

    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check out pinned Semgrep rules
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: semgrep/semgrep-rules
          ref: 311ca4e9ba59d700624539bf658e3d29b134ee77
          path: .semgrep-rules
          persist-credentials: false

      - name: Run Semgrep
        # This upstream rule flags every non-string assert. PHP 8.1+ does not
        # evaluate assertion strings as code, and this SDK uses boolean invariants.
        run: >-
          docker run --rm
          --volume "$GITHUB_WORKSPACE:/src"
          --workdir /src
          semgrep/semgrep:1.170.0@sha256:c98f8829eea377274ee4b10656458b078b88232469b2ff913f091c2317347c9d
          semgrep scan
          --config .semgrep-rules/php
          --exclude-rule semgrep-rules.php.lang.security.assert-use
          --error
          --metrics=off
          --sarif
          --output semgrep.sarif
          --exclude vendor
          --exclude .phpunit.cache
          --exclude .semgrep-rules
          .

      - name: Upload SARIF artifact
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: semgrep-results
          path: semgrep.sarif
          if-no-files-found: error
          retention-days: 5

      - name: Upload to code scanning
        if: always()
        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          sarif_file: semgrep.sarif