Repository navigation

chore(deps): update module sigs.k8s.io/structured-merge-diff/v4 to v7 #665

	name: Semgrep

	on:
	# Scan changed files in PRs, block on new issues only (existing issues ignored)
	pull_request: {}

	jobs:
	semgrep:
	name: Scan
	runs-on: ubuntu-latest
	# Skip any PR created by dependabot to avoid permission issues
	if: (github.actor != 'dependabot[bot]')
	container:
	image: semgrep/semgrep:1.179.0@sha256:93963d9295a366f59e4850127b1550400ee7b388f04fe144e4a1f6325d96e01b
	steps:
	# Fetch project source
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- name: Run Semgrep
	run: \|
	semgrep scan \
	--sarif \
	--output=semgrep.sarif \
	--config="p/security-audit" \
	--config="p/secrets" \
	--config="p/ci" \
	--config="p/default" \
	--config="p/docker" \
	--config="p/dockerfile" \
	--config="p/command-injection"

	# Upload findings to GitHub Advanced Security Dashboard [step 2/2]
	- name: Upload SARIF file for GitHub Advanced Security Dashboard
	uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
	with:
	sarif_file: semgrep.sarif