name: semgrep
on:
  pull_request:
    branches: ["main", "release/**"]
  push:
    branches: ["main"]
permissions:
  contents: read

# Cancel superseded PR runs (same rule as quality.yml). No paths filter on purpose:
# p/secrets must keep scanning docs-only diffs too — credentials leak in .md files.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Run semgrep (advisory)
        continue-on-error: true
        run: |
          semgrep scan --config p/owasp-top-ten --config p/secrets \
            --sarif --output semgrep.sarif --metrics off || true
          python -c "import json; d=json.load(open('semgrep.sarif')); print('semgrepFindings=%d' % len(d['runs'][0]['results']))" || echo "semgrepFindings=SKIP"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: semgrep-sarif
          path: semgrep.sarif
          retention-days: 14