merged.semgrep.yml

name: "CI"

# This workflow will run after a merge to the main branch from a pull request, and as a scheduled job.

on:
  merge_group:
  push:
    branches:
      - main
  schedule:
    - cron: "30 0 1,15 * *"

permissions:
  contents: read

jobs:
  semgrep:
    name: "Semgrep"
    runs-on: ubuntu-latest

    container:
      image: returntocorp/semgrep

    steps:
      - uses: actions/checkout@v3

      - run: semgrep ci
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}