This repository was archived by the owner on May 21, 2026. It is now read-only.

chore: pin github actions to commit shas #1

	on:
	pull_request:
	merge_group:

	name: Semgrep

	permissions:
	contents: read

	env:
	SEMGREP_ENABLE_VERSION_CHECK: 'false'

	jobs:
	# scans GitHub Actions and other repo-wide config
	semgrep:
	runs-on: ubuntu-latest
	container:
	image: semgrep/semgrep

	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Checkout .github repo (for custom semgrep rules)
	uses: actions/checkout@v6
	with:
	repository: PostHog/.github
	path: dotgithub-repo
	sparse-checkout: .semgrep

	- name: Check for .github directory
	id: check
	run: \|
	if [ -d ".github/" ]; then
	echo "exists=true" >> "$GITHUB_OUTPUT"
	fi

	- name: Run Semgrep
	if: steps.check.outputs.exists == 'true'
	run: \|
	semgrep \
	--config "dotgithub-repo/.semgrep/rules/" \
	--config "p/owasp-top-ten" \
	--config "p/security-audit" \
	--config "p/trailofbits" \
	--config "p/github-actions" \
	--exclude-rule trailofbits.generic.curl-unencrypted-url.curl-unencrypted-url \
	--exclude-rule dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile \
	--exclude-rule trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport \
	--exclude-rule trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces \
	--error \
	--metrics=off \
	--verbose \
	.github/

Navigation Menu