Open github-learning-lab[bot] opened 3 years ago
B
Great! Now we're going to set up Semgrep scanning every PR via GitHub actions by creating a semgrep.yml
.
Though we're going to be using GitHub Actions in this workshop, because Semgrep is nice and portable, easily runnable as a standalone binary or Docker, it's pretty easy to set up Semgrep in pretty much any CI platform under the sun.
See these docs for info about setting up Semgrep in GitLab, Buildkit, CircleCI, or other providers, and see here for more info about Semgrep in CI.
semgrep.yml
to repos you want to onboard, etc.).intro-to-semgrep
repo. If you want to add more repos, you select "All repositories" or hand select a few more. You can always update this later via your GitHub profile Installed Applications settings.intro-to-semgrep
repo row.intro-to-semgrep
repo.
semgrep.yml
GitHub Action) to this repo.
This issue collects various links to useful Semgrep resources and documentation in one place so you can reference it if you ever get stuck.
returntocorp/semgrep-rules
repo, as the Registry includes Semgrep rules from other community repos, like NodeJSScan or Go rules by Damian Gryski.Rule Writing
There's a step by step rule writing tutorial here.
If you go to the Playground, you can also click the "Examples" button to view a number of illustrative built-in examples.
And of course, you can also review the over 1,000 rules in @returntocorp/semgrep-rules.
Docs
Semgrep has pretty extensive docs, which you can view here.
Of note:
this
ANDthat
, orthis
but NOTthat
, etc.Community
Feel free to join the r2c community Slack to ask questions (we're super responsive!) or reach out to us on Twitter (@r2cdev), or send us an email at support@r2c.dev.