ci: run semgrep workflow on call

semgr8ns · May 28, 2024 · 41462a0 · 41462a0
1 parent c7fbf14
commit 41462a0
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 9 deletions.
diff --git a/.github/workflows/.reusable-ci.yml b/.github/workflows/.reusable-ci.yml
@@ -144,6 +144,11 @@ jobs:
       skip: ${{ needs.conditionals.outputs.skip_sast }}
       output: ${{ needs.conditionals.outputs.output_type }}
 
+  semgrep:
+    uses: ./.github/workflows/semgrep.yml
+    needs: [sast]
+    secrets: inherit
+
   sca:
     uses: ./.github/workflows/.reusable-sca.yml
     needs: [conditionals, build]

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
@@ -1,23 +1,22 @@
 name: Semgrep
+
+permissions: {}
+
 on:
   workflow_dispatch: {}
-  pull_request: {}
-  push:
-    branches:
-      - main
-    paths:
-      - .github/workflows/semgrep.yml
-  schedule:
-    - cron: '11 21 * * *'
+  workflow_call: {}
+
 jobs:
   semgrep:
     name: semgrep/ci
     runs-on: ubuntu-latest
+    if: |
+      (github.event_name != 'push') &&
+      (github.actor != 'dependabot[bot]')
     env:
       SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
     container:
       image: semgrep/semgrep
-    if: (github.actor != 'dependabot[bot]')
     steps:
       - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
       - run: semgrep ci