Skip to content

Commit c7411ff

Browse files
authored
[azp] Support Semgrep (#132)
#### Why I did it [Semgrep](https://github.com/returntocorp/semgrep) is a static analysis tool to find security vulnerabilities. Ref: - [Supported Language](https://semgrep.dev/docs/supported-languages/#language-maturity) - [Semgrep Rules](https://registry.semgrep.dev/rule) #### How I did it Integrate Semgrep into this repository by committing a job configuration file When this PR merged, it forces developers to follow and must pass Semgrep checker
1 parent 6a281c8 commit c7411ff

File tree

1 file changed

+18
-0
lines changed

1 file changed

+18
-0
lines changed

azure-pipelines.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,24 @@ pr:
1414
- master
1515

1616
stages:
17+
- ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
18+
- stage: Analysis
19+
dependsOn: []
20+
jobs:
21+
- job:
22+
displayName: "Semgrep"
23+
pool:
24+
vmImage: ubuntu-latest
25+
steps:
26+
- script: |
27+
set -ex
28+
target_branch=origin/$(System.PullRequest.TargetBranch)
29+
files_changed=$(git --no-pager diff $target_branch..HEAD --name-only --diff-filter=d)
30+
python -m pip install --upgrade pip
31+
pip install semgrep
32+
semgrep --config "p/default" --error $files_changed
33+
displayName: 'Run Semgrep'
34+
1735
- stage: Build
1836
jobs:
1937
- job:

0 commit comments

Comments
 (0)