name: semgrep

on:
  push:
    branches-ignore:
      # Error: Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#scanning-on-push for more information on how to configure these events.
      - dependabot/**
  pull_request:

jobs:
  semgrep:
    runs-on: ubuntu-latest

    continue-on-error: true # TODO: remove when semgrep fixed: https://github.com/returntocorp/semgrep-action/issues/429

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Run semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            .semgrep/
          generateSarif: "1"
        env:
          SEMGREP_AGENT_DEBUG: 1 # https://github.com/returntocorp/semgrep-action/issues/429

      - name: Upload SARIF file to GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: semgrep.sarif
        if: always()

name: semgrep

on:
  push:
    branches-ignore:
      # Error: Workflows triggered by Dependabot on the "push" event run with read-only access. Uploading Code Scanning results requires write access. To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. See https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#scanning-on-push for more information on how to configure these events.
      - dependabot/**
  pull_request:

jobs:
  semgrep:
    runs-on: ubuntu-latest

    continue-on-error: true # TODO: remove when semgrep fixed: https://github.com/returntocorp/semgrep-action/issues/429

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Run semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            .semgrep/
          generateSarif: "1"
        env:
          SEMGREP_AGENT_DEBUG: 1 # https://github.com/returntocorp/semgrep-action/issues/429

      - name: Upload SARIF file to GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: semgrep.sarif
        if: always()

Bump github/codeql-action from 1 to 2
Bump github/codeql-action from 1 to 2

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 1 to 2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v1...v2)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <5bdcd3c0d4d24ae3e71b3b452a024c6324c7e4bb@github.com>