security.yml

name: Security

# Disabling Security workflow for now.
# TODO: Enable this workflow once we have a stable version of Semgrep rules.
on: []
#on: [push, pull_request]

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: software-mansion/setup-scarb@v1
        with:
          scarb-version: "0.7.0"

      - name: Install Semgrep
        run: |
          pip install semgrep
      - name: Run Semgrep
        run: semgrep --config https://github.com/avnu-labs/semgrep-cairo-rules/releases/download/v0.0.1/cairo-rules.yaml ./src > semgrep-output.txt
      - name: Save Semgrep Output as an Artifact
        uses: actions/upload-artifact@v3
        with:
          name: semgrep-cairo
          path: semgrep-output.txt

      - name: Build cairo programs
        run: scarb build

      - name: Cache Cargo dependencies
        uses: actions/cache@v2
        with:
          path: |
            ~/.cargo
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

      - name: Check if Caracal is installed
        id: check-caracal
        run: |
          if ! command -v caracal &> /dev/null; then
            echo "Caracal is not installed. Installing..."
            cargo install --git https://github.com/crytic/caracal --profile release --force
          else
            echo "Caracal is already installed."
          fi
      - name: Run Caracal
        run: caracal detect . > caracal-output.txt
      - name: Save Caracal Output as an Artifact
        uses: actions/upload-artifact@v3
        with:
          name: caracal-cairo
          path: caracal-output.txt