semgrep-self-test.yml

name: semgrep-self-test
on:
  workflow_dispatch:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    branches: [main]
permissions:
  # This is a public repo, no permissions required to clone
  contents: none
jobs:
  semgrep-self-test:
    name: semgrep-self-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: |
          python3 -m pip --disable-pip-version-check install -r requirements.txt
        shell: bash
      - run: |
          cd assets/semgrep_rules/; semgrep --test --disable-version-check --strict --metrics=off
        shell: bash
      - run: |
          JSON=$(semgrep \
            --disable-version-check --strict --metrics=off --json \
            $(find assets/semgrep_rules -name '*.yml' -or -name '*.yaml' -not -name '*.test.yml' -not -name '*.test.yaml' -not -path "assets/semgrep_rules/generated/*" | sed 's/^/-c /g') \
            assets/semgrep_rules/{client,services} || true)
          ERRORS=$(echo "$JSON" | jq '.errors' || true)
          BADERRS=$(echo "$ERRORS" | jq '.[] | select(.level == "error")' || true)
          if [[ -n "$BADERRS" ]]; then
            echo "Semgrep rule / version issue: $BADERRS"
            exit 123
          fi
          RESULTCOUNT=$(echo "$JSON" | tr '\n' ' ' | tr '\t' ' ' | jq '.results | length')
          NUMRESULTS=$(grep -R ruleid: | wc -l)
          if [[ "$RESULTCOUNT" -lt "$NUMRESULTS" ]]; then
            echo "Found fewer than $NUMRESULTS semgrep results"
            exit 122
          fi
        shell: bash