From 31e1158c112029f275a1422c1b3c59b91c052e78 Mon Sep 17 00:00:00 2001
From: Ryan Laddusaw <rladdusaw@princeton.edu>
Date: Mon, 23 Sep 2024 13:30:37 -0400
Subject: [PATCH] semgrep config and issues

---
 .circleci/config.yml |  9 +++++++++
 .semgrepignore       | 18 ++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 .semgrepignore

diff --git a/.circleci/config.yml b/.circleci/config.yml
index cc0bfdb..d4fbf81 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -72,6 +72,14 @@ jobs:
       - checkout
       - run: curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /tmp
       - run: CURRENT_BRANCH=$CIRCLE_BRANCH SHA=$CIRCLE_SHA1 /tmp/bearer scan .
+  semgrep:
+    docker:
+        - image: returntocorp/semgrep
+    steps:
+      - checkout
+      - run:
+          name: Check code against community-provided and custom semgrep rules
+          command: semgrep ci --config auto
 workflows:
   version: 2
   build_and_test:
@@ -90,3 +98,4 @@ workflows:
           requires:
             - build
       - bearer
+      - semgrep
diff --git a/.semgrepignore b/.semgrepignore
new file mode 100644
index 0000000..f0a93db
--- /dev/null
+++ b/.semgrepignore
@@ -0,0 +1,18 @@
+# Common large paths
+node_modules/
+vendor/
+*.min.js
+spec/
+.github/
+
+# Semgrep rules folder
+.semgrep
+
+# Semgrep-action log folder
+.semgrep_logs/
+
+# Tickets to remediate these rules and remove from this list
+config/
+# https://github.com/pulibrary/repecwp/issues/143
+app/controllers/
+# https://github.com/pulibrary/repecwp/issues/144