Test tiers: split slow e2e and upstream-gated live out of default integration glob #17370

	name: semgrep
	on:
	pull_request:
	branches: ["main", "release/**"]
	push:
	branches: ["main"]
	permissions:
	contents: read

	# Cancel superseded PR runs (same rule as quality.yml). No paths filter on purpose:
	# p/secrets must keep scanning docs-only diffs too — credentials leak in .md files.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true
	jobs:
	semgrep:
	runs-on: ubuntu-latest
	container:
	image: semgrep/semgrep
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: Run semgrep (advisory)
	continue-on-error: true
	run: \|
	semgrep scan --config p/owasp-top-ten --config p/secrets \
	--sarif --output semgrep.sarif --metrics off \|\| true
	python -c "import json; d=json.load(open('semgrep.sarif')); print('semgrepFindings=%d' % len(d['runs'][0]['results']))" \|\| echo "semgrepFindings=SKIP"
	- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	if: always()
	with:
	name: semgrep-sarif
	path: semgrep.sarif
	retention-days: 14

Navigation Menu