{"id":17117636,"url":"https://github.com/j3ssie/sample-semgrep-ci","last_synced_at":"2025-07-24T22:33:50.787Z","repository":{"id":214281171,"uuid":"736137803","full_name":"j3ssie/sample-semgrep-ci","owner":"j3ssie","description":"Github Action Example with Semgrep SAST","archived":false,"fork":false,"pushed_at":"2023-12-27T05:15:22.000Z","size":248,"stargazers_count":5,"open_issues_count":1,"forks_count":5,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-01T18:21:18.725Z","etag":null,"topics":["sast","semgrep","semgrep-action"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/j3ssie.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-12-27T04:58:43.000Z","updated_at":"2024-12-16T11:56:43.000Z","dependencies_parsed_at":null,"dependency_job_id":"978d5e09-4a13-46ab-a45d-c3c5bf378081","html_url":"https://github.com/j3ssie/sample-semgrep-ci","commit_stats":null,"previous_names":["j3ssie/sample-semgrep-ci"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/j3ssie/sample-semgrep-ci","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/j3ssie%2Fsample-semgrep-ci","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/j3ssie%2Fsample-semgrep-ci/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/j3ssie%2Fsample-semgrep-ci/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/j3ssie%2Fsample-semgrep-ci/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/j3ssie","download_url":"https://codeload.github.com/j3ssie/sample-semgrep-ci/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/j3ssie%2Fsample-semgrep-ci/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266913721,"owners_count":24005582,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-24T02:00:09.469Z","response_time":99,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["sast","semgrep","semgrep-action"],"created_at":"2024-10-14T17:52:17.463Z","updated_at":"2025-07-24T22:33:50.325Z","avatar_url":"https://github.com/j3ssie.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Github Action Example with Semgrep SAST\n\nThis repository contains an example workflow showcasing the integration of Semgrep, a powerful static analysis tool, within a GitHub Actions workflow for performing Static Application Security Testing (SAST).\n\n## Workflow Overview\n\nThe provided GitHub Actions workflow demonstrates how to:\n\n- Run Semgrep scan on your codebase.\n- Save the scan results in SARIF format.\n- Upload the SARIF file as an artifact.\n- Utilize the GitHub `upload-sarif` action to display scan findings in the GitHub Security tab.\n\n## Contents\n\n- `.github/workflows/`: Contains the workflow YAML file.\n- `vulnerable-source-code/`: Placeholder directory representing the codebase for scanning.\n- `README.md`: Instructions and overview.\n\nFeel free to use this as a reference for integrating Semgrep scans into your CI/CD pipelines and enhancing your code security.\n\n## Manual Usage\n\n```bash\nsemgrep scan -j 100 --config p/default --config ./custom-semgrep-rules/ src \u003e out.txts\n\n# with sarif format\nsemgrep scan -j 100 -q --sarif --config p/default --config ./custom-semgrep-rules/ src \u003e semgrep-result.sarif\n\nsemgrep scan -j 100 -q --sarif --config p/default --config ./custom-semgrep-rules/ src \u003e semgrep-result.sarif\n```\n\n\u003e Tips: Using [SARIF Viewer](https://marketplace.visualstudio.com/items?itemName=MS-SarifVSCode.sarif-viewer) in VSCode or [sarif-tools](https://github.com/microsoft/sarif-tools) to beautify the sarif format file\n\n## Github Action File\n\n```yaml\n# Name of this GitHub Actions workflow.\nname: Semgrep\n\non:\n  # Scan changed files in PRs (diff-aware scanning):\n  pull_request: {}\n  # Scan on-demand through GitHub Actions interface:\n  workflow_dispatch: {}\n  # Scan mainline branches and report all findings:\n  push:\n    branches: [\"master\", \"main\"]\n\njobs:\n  semgrep_scan:\n    # User definable name of this GitHub Actions job.\n    name: semgrep/ci\n    # If you are self-hosting, change the following `runs-on` value:\n    runs-on: ubuntu-latest\n    container:\n      # A Docker image with Semgrep installed. Do not change this.\n      image: returntocorp/semgrep\n    # Skip any PR created by dependabot to avoid permission issues:\n    if: (github.actor != 'dependabot[bot]')\n    permissions:\n      # required for all workflows\n      security-events: write\n      # only required for workflows in private repositories\n      actions: read\n      contents: read\n\n    steps:\n      # Fetch project source with GitHub Actions Checkout.\n      - name: Checkout repository\n        uses: actions/checkout@v3\n\n      - name: Perform Semgrep Analysis\n      # @NOTE: This is the actual semgrep command to scan your code.\n      # Modify the --config option to 'r/all' to scan using all rules,\n      # or use multiple flags to specify particular rules, such as\n      # --config r/all --config custom/rules\n        run: semgrep scan -q --sarif --config auto ./vulnerable-source-code \u003e semgrep-results.sarif\n\n      # upload the results for the CodeQL GitHub app to annotate the code\n      - name: Save SARIF results as artifact\n        uses: actions/upload-artifact@v3\n        with:\n          name: semgrep-scan-results\n          path: semgrep-results.sarif\n\n      # Upload SARIF file generated in previous step\n      - name: Upload SARIF result to the GitHub Security Dashboard\n        uses: github/codeql-action/upload-sarif@v2\n        with:\n          sarif_file: semgrep-results.sarif\n        if: always()\n\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fj3ssie%2Fsample-semgrep-ci","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fj3ssie%2Fsample-semgrep-ci","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fj3ssie%2Fsample-semgrep-ci/lists"}