build(deps): bump listr2 from 10.2.2 to 11.0.0 #702

	name: Semgrep

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: "20 17 * * 1"

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	# Top-level least-privilege; the semgrep job opts into security-events:write
	# explicitly so the SARIF upload step can post results. (Scorecard Token-Permissions)
	permissions:
	contents: read

	jobs:
	semgrep:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	container:
	image: semgrep/semgrep
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- name: semgrep scan (p/auto + p/owasp-top-ten)
	# `\|\| true` so the SARIF upload step still runs on findings;
	# gating happens through GitHub code scanning, not the scan's
	# exit code. `returntocorp/semgrep` is the deprecated legacy
	# image (the org renamed to `semgrep/`), and `semgrep ci`
	# rejects --config flags — so we invoke `semgrep scan` directly.
	run: \|
	semgrep scan \
	--config p/auto \
	--config p/owasp-top-ten \
	--sarif --output=semgrep.sarif \
	--metrics=off \|\| true
	- uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
	if: always()
	with:
	sarif_file: semgrep.sarif
	category: semgrep

Navigation Menu