name: Semgrep OSS scan
on:
  pull_request: {}
  push:
    branches: [main]
  workflow_dispatch: {}
  schedule:
    - cron: "0 0 15 * *"
concurrency:
  group: semgrep-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true
permissions:
  contents: read
jobs:
  semgrep:
    name: semgrep-oss
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 1
          persist-credentials: false
      - id: cache-semgrep
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ~/.local
          key: semgrep-1.160.0-${{ runner.os }}
      - if: steps.cache-semgrep.outputs.cache-hit != 'true'
        run: pip install --user semgrep==1.160.0
      - run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - run: semgrep scan --config=auto || true