https://github.com/hoeg/semgrep-report
Github action for reporting semgrep findings to PRs
https://github.com/hoeg/semgrep-report
github-actions pull-requests security semgrep
Last synced: 7 months ago
JSON representation
Github action for reporting semgrep findings to PRs
- Host: GitHub
- URL: https://github.com/hoeg/semgrep-report
- Owner: hoeg
- License: mit
- Created: 2022-11-11T18:35:11.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2024-06-21T19:37:58.000Z (about 2 years ago)
- Last Synced: 2025-08-23T06:41:06.262Z (12 months ago)
- Topics: github-actions, pull-requests, security, semgrep
- Language: TypeScript
- Homepage:
- Size: 1.84 MB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 6
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: CODEOWNERS
Awesome Lists containing this project
README
# Semgrep Reporting Action
Report your Semgrep findings back to the PR where they have been found.
## Add this action to your workflow
We show an example of how you can add this step to your workflow.
Note that you have to setup and run the Semgrep scanning yourself.
This step only parses the result and reports back to the PR that is being run.
Remember to only set
```yaml
on:
pull_request: {}
```
in your action as the action looks for comparison information using `github.context.payload.pull_request`.
```yaml
- name: Checkout
uses: actions/checkout@v3
- name: Scan
run: semgrep scan -f rules -l tf --json --output=semgrep.json .
- uses: hoeg/semgrep-report@v1
with:
github_secret: ${{secrets.GITHUB_TOKEN}}
report_path: ./semgrep.json
base_path: /
```
`base_path` is optional and only needs to be set if you have not checked out the repository to `/`