security-sast-common.yml

name: Common SAST (Semgrep)

on:
  workflow_call:
    inputs:
      config:
        description: 'Semgrep config (e.g., p/security-audit, p/golang)'
        type: string
        default: 'p/security-audit'
      extra_config:
        description: 'Additional Semgrep configs (space-separated)'
        type: string
        default: ''
    outputs:
      findings:
        description: 'Total Semgrep findings'
        value: ${{ jobs.semgrep.outputs.findings }}
      high:
        description: 'HIGH/ERROR severity findings'
        value: ${{ jobs.semgrep.outputs.high }}
      medium:
        description: 'MEDIUM/WARNING severity findings'
        value: ${{ jobs.semgrep.outputs.medium }}

jobs:
  semgrep:
    name: Semgrep SAST
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
    outputs:
      findings: ${{ steps.scan.outputs.findings }}
      high: ${{ steps.scan.outputs.high }}
      medium: ${{ steps.scan.outputs.medium }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Run Semgrep
        id: scan
        env:
          SEMGREP_CONFIG: ${{ inputs.config }}
          SEMGREP_EXTRA_CONFIG: ${{ inputs.extra_config }}
        run: |
          EXTRA_ARG=""
          if [ -n "$SEMGREP_EXTRA_CONFIG" ]; then
            EXTRA_ARG="--config=$SEMGREP_EXTRA_CONFIG"
          fi
          docker run --rm -v "$PWD:/src" -w /src semgrep/semgrep:1.156.0 \
            semgrep scan \
            --config="$SEMGREP_CONFIG" \
            $EXTRA_ARG \
            --json --output=semgrep.json \
            --sarif --sarif-output=semgrep.sarif \
            . || true

      - name: Parse results
        id: parse
        run: |
          if [ -f semgrep.json ]; then
            FINDINGS=$(jq '.results | length' semgrep.json 2>/dev/null || echo "0")
            # Semgrep uses "ERROR" for high severity, "WARNING" for medium
            HIGH=$(jq '[.results[]? | select(.extra.severity == "ERROR")] | length' semgrep.json 2>/dev/null || echo "0")
            MEDIUM=$(jq '[.results[]? | select(.extra.severity == "WARNING")] | length' semgrep.json 2>/dev/null || echo "0")

            echo "findings=$FINDINGS" >> $GITHUB_OUTPUT
            echo "high=$HIGH" >> $GITHUB_OUTPUT
            echo "medium=$MEDIUM" >> $GITHUB_OUTPUT

            if [ "$HIGH" -gt 0 ]; then
              echo "::error::$HIGH HIGH severity Semgrep finding(s)"
            fi
            if [ "$MEDIUM" -gt 0 ]; then
              echo "::warning::$MEDIUM MEDIUM severity Semgrep finding(s)"
            fi
          else
            echo "findings=0" >> $GITHUB_OUTPUT
            echo "high=0" >> $GITHUB_OUTPUT
            echo "medium=0" >> $GITHUB_OUTPUT
          fi

          # Write summary
          echo "### Semgrep Results" >> $GITHUB_STEP_SUMMARY
          echo "| Severity | Count |" >> $GITHUB_STEP_SUMMARY
          echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| HIGH | ${HIGH:-0} |" >> $GITHUB_STEP_SUMMARY
          echo "| MEDIUM | ${MEDIUM:-0} |" >> $GITHUB_STEP_SUMMARY
          echo "| **Total** | **${FINDINGS:-0}** |" >> $GITHUB_STEP_SUMMARY

      - name: Upload SARIF
        if: hashFiles('semgrep.sarif') != ''
        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4
        with:
          sarif_file: semgrep.sarif
          category: semgrep
        continue-on-error: true

      - name: Upload artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: always()
        with:
          name: semgrep-results
          path: |
            semgrep.json
            semgrep.sarif
          retention-days: 30
          if-no-files-found: ignore