moved from codacy to semgrep

.github/workflows/codecoverage.yml

@@ -5,8 +5,15 @@ on:
     # branches to consider in the event; optional, defaults to all
     branches:
       - main
+  pull_request:
+    branches:
+      - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+  code-quality: write
+
 jobs:  
   codecoverage:
     name: "Code Coverage"
@@ -16,7 +23,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2.3.4    
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
     - name: Restore Nuget Packages
       run: dotnet restore EstateManagementUI.sln --source ${{ secrets.PUBLICFEEDURL }} --source ${{ secrets.PRIVATEFEED_URL }}
@@ -27,18 +36,13 @@ jobs:
     - name: Run Unit Tests
       run: |
         echo "ASPNETCORE_ENVIRONMENT are > ${ASPNETCORE_ENVIRONMENT}"
-        dotnet test EstateManagementUI.BlazorServer.Tests/EstateManagementUI.BlazorServer.Tests.csproj --settings .runsettings /p:CollectCoverage=true /p:Exclude="[xunit*]*" /p:ExcludeByAttribute="Obsolete" /p:ExcludeByAttribute="GeneratedCodeAttribute" /p:ExcludeByAttribute="ExcludeFromCodeCoverageAttribute" /p:CoverletOutput="../lcov1.info" /maxcpucount:1 /p:CoverletOutputFormat="lcov"
-
-    - name: Install LCOV merger
-      run: npm install -g lcov-result-merger
-
-    - name: Merge LCOV reports
-      run: |
-        mkdir -p coverage
-        lcov-result-merger "*.info" > lcov.info
+        mkdir -p "$GITHUB_WORKSPACE/coverage"
+        dotnet test EstateManagementUI.BlazorServer.Tests/EstateManagementUI.BlazorServer.Tests.csproj --settings .runsettings /p:CollectCoverage=true /p:Exclude="[xunit*]*" /p:ExcludeByAttribute="Obsolete" /p:ExcludeByAttribute="GeneratedCodeAttribute" /p:ExcludeByAttribute="ExcludeFromCodeCoverageAttribute" /p:CoverletOutput="$GITHUB_WORKSPACE/coverage/coverage" /maxcpucount:1 /p:CoverletOutputFormat="cobertura"
 
-    - name: Upload merged coverage to Codacy
-      uses: codacy/codacy-coverage-reporter-action@v1
+    - name: Upload coverage report
+      if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+      uses: actions/upload-code-coverage@v1
       with:
-        project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
-        coverage-reports: ./lcov.info      
+        file: ${{ github.workspace }}/coverage/coverage.cobertura.xml
+        language: C#
+        label: code-coverage/blazor

.github/workflows/semgrep.yml

@@ -0,0 +1,49 @@
+name: Semgrep
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+    inputs:
+      min_severity:
+        description: "Minimum severity for GitHub issues"
+        required: false
+        default: warning
+        type: choice
+        options:
+          - warning
+          - error
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  scan:
+    name: Scan and Sync
+    runs-on: ubuntu-latest
+
+    env:
+      SEMGREP_MIN_SEVERITY: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.min_severity || vars.SEMGREP_MIN_SEVERITY || 'warning' }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run Semgrep
+        run: |
+          set +e
+          docker run --rm -v "$GITHUB_WORKSPACE:/src" -w /src semgrep/semgrep:latest semgrep scan --config auto --json --output /src/semgrep.json /src
+          code=$?
+          set -e
+          if [ "$code" -gt 1 ]; then
+            exit "$code"
+          fi
+
+      - name: Sync Semgrep findings to GitHub issues
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: node scripts/semgrep-sync-issues.mjs semgrep.json

.semgrepignore

@@ -0,0 +1,19 @@
+Archive/**
+**/Archive/**
+
+EstateManagementUI.BlazorServer.Tests/**
+EstateManagementUI.IntegrationTests/**
+
+bin/**
+obj/**
+.vs/**
+.vscode/**
+.idea/**
+node_modules/**
+TestResults/**
+
+**/*.g.cs
+**/*.g.i.cs
+**/*.designer.cs
+**/*.Generated.cs
+**/Generated/**