chore(deps): update all non-major dependencies #223

	name: Semgrep

	on:
	# Scan changed files in PRs, block on new issues only (existing issues ignored)
	pull_request: {}

	jobs:
	semgrep:
	name: Scan
	runs-on: ubuntu-latest
	# Skip any PR created by dependabot to avoid permission issues
	if: (github.actor != 'dependabot[bot]')
	container:
	image: semgrep/semgrep:1.174.0@sha256:f1f7b71861c7b28b6e0f661225a2c4f58a484f5d0f182465c6d6b3b22f972ade
	steps:
	# Fetch project source
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- name: Run Semgrep
	run: \|
	semgrep scan \
	--sarif \
	--output=semgrep.sarif \
	--config="p/security-audit" \
	--config="p/secrets" \
	--config="p/ci" \
	--config="p/default" \
	--config="p/docker" \
	--config="p/dockerfile" \
	--config="p/command-injection"

	# Upload findings to GitHub Advanced Security Dashboard [step 2/2]
	- name: Upload SARIF file for GitHub Advanced Security Dashboard
	uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
	with:
	sarif_file: semgrep.sarif

Navigation Menu