Add semgrep to ci workflow (#11)

resonatehq · Aug 31, 2023 · 111498c · 111498c
1 parent 8a7247f
commit 111498c
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 0 deletions.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -39,3 +39,15 @@ jobs:
       uses: codecov/codecov-action@v3
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
+
+  semgrep:
+    name: semgrep
+    runs-on: ubuntu-20.04
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+    container:
+      image: returntocorp/semgrep
+    if: (github.actor != 'dependabot[bot]')
+    steps:
+    - uses: actions/checkout@v3
+    - run: semgrep ci
diff --git a/semgrep.yml b/semgrep.yml
@@ -0,0 +1,11 @@
+rules:
+- id: range-over-map
+  pattern-either:
+  - pattern: |
+      for $K, $V := range ($MAP : map[$KT]$VT) { ... }
+  - pattern: |
+      for $K := range ($MAP : map[$KT]$VT) { ... }
+  message: Ranging over a map is non deterministic
+  languages:
+  - go
+  severity: ERROR