semgrep-rule-lints.yaml

# Based off https://github.com/returntocorp/semgrep-rules/blob/develop/.github/workflows/semgrep-rule-lints.yaml

name: semgrep-rule-lints

on:
  pull_request:
  push:
    branches: [main]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    name: semgrep-rule-lints
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: install semgrep
        run: pip3 install semgrep
      - name: lints for semgrep rules
        run: |
          semgrep \
            --error \
            --config r/yaml.semgrep.duplicate-id \
            --config r/yaml.semgrep.duplicate-pattern \
            --config r/yaml.semgrep.unsatisfiable \
            --config r/yaml.semgrep.empty-message \
            --config r/yaml.semgrep.missing-message-field \
            --config r/yaml.semgrep.missing-language-field \
            --config r/yaml.semgrep.metadata-confidence \
            --config r/yaml.semgrep.metadata-likelihood \
            --config r/yaml.semgrep.metadata-impact \
            --config r/yaml.semgrep.metadata-subcategory \
            --config r/yaml.semgrep.metadata-confidence-incorrect-value \
            --config r/yaml.semgrep.metadata-likelihood-incorrect-value \
            --config r/yaml.semgrep.metadata-impact-incorrect-value \
            --config r/yaml.semgrep.metadata-subcategory-incorrect-value \
            --config r/yaml.semgrep.metadata-technology \
            --config r/yaml.semgrep.metadata-category \
            --config r/yaml.semgrep.multi-line-message \
            --config r/yaml.semgrep.message-whitespace \
            --config r/yaml.semgrep.metadata-deepsemgrep \
            --config r/yaml.semgrep.slow-pattern-top-ellipsis \
            --config r/yaml.semgrep.rule-missing-deconstructed-value \
            --exclude *.test.yaml \
            --exclude contrib/ \
            --exclude stats/ \
            --exclude fingerprints/ \
            --exclude yaml/semgrep/