security_scan.yml

# Perform Static Application Security Testing (SAST) scanning on Cloud Manager.
name: Security Scan

on:
  push:
    branches:
      - develop

jobs:
  security-scan:
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep
    steps:
    - uses: actions/checkout@v3

      # Perform scanning using Semgrep
      # Pass even when it identifies issues or encounters errors.
    - name: Run SAST scan
      if: always()
      run: semgrep ci || true
      env:
         SEMGREP_RULES: p/default

      # Post results to Slack notification channel.
    - name: slack-notify
      uses: rtCamp/action-slack-notify@master
      env:
          SLACK_WEBHOOK: ${{ secrets.SLACK_SAST_WEBHOOK }}
          SLACK_MESSAGE: "Message: ${{ github.event.head_commit.message }} \nRepository: ${{ github.event.repository.url }}"
          SLACK_COLOR: ${{ job.status }}
          SLACK_FOOTER: ''
          MSG_MINIMAL: event,actions url,commit