Repository navigation
Revamp the PostHog AI page #24033
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| on: | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| name: Security | |
| permissions: | |
| contents: read | |
| env: | |
| SEMGREP_ENABLE_VERSION_CHECK: 'false' | |
| jobs: | |
| semgrep-js: | |
| runs-on: ubuntu-latest | |
| container: | |
| image: semgrep/semgrep:1.163.0@sha256:7cad2bc2d1e44f87f0bf4be6d1fa23aa90fb72015bebc89fb91385d813987a03 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # exclude react-markdown rule: we use rehypeSanitize to sanitize HTML output | |
| - name: Run Semgrep | |
| run: | | |
| semgrep \ | |
| --config "p/javascript" \ | |
| --config "p/owasp-top-ten" \ | |
| --config "p/security-audit" \ | |
| --config "p/trailofbits" \ | |
| --exclude-rule typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html \ | |
| --error \ | |
| --metrics=off \ | |
| --verbose \ | |
| src/ gatsby/ plugins/ api/ *.js *.ts *.tsx | |
| # scans GitHub Actions and other repo-wide config | |
| semgrep-general: | |
| runs-on: ubuntu-latest | |
| container: | |
| image: semgrep/semgrep:1.163.0@sha256:7cad2bc2d1e44f87f0bf4be6d1fa23aa90fb72015bebc89fb91385d813987a03 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # exclude all directories already scanned by other jobs | |
| - name: Run Semgrep | |
| run: | | |
| semgrep \ | |
| --config "p/owasp-top-ten" \ | |
| --config "p/security-audit" \ | |
| --config "p/trailofbits" \ | |
| --config "p/github-actions" \ | |
| --error \ | |
| --metrics=off \ | |
| --verbose \ | |
| --exclude ./src/ \ | |
| --exclude ./gatsby/ \ | |
| --exclude ./plugins/ \ | |
| --exclude ./api/ \ | |
| --exclude ./contents/ \ | |
| . | |
| semgrep_checks: | |
| needs: [semgrep-js, semgrep-general] | |
| name: Semgrep Checks Pass | |
| runs-on: ubuntu-latest | |
| if: always() | |
| steps: | |
| - name: Check matrix outcome | |
| run: | | |
| if [[ "${{ needs.semgrep-js.result }}" != "success" && "${{ needs.semgrep-js.result }}" != "skipped" ]]; then | |
| echo "semgrep-js did not complete successfully." | |
| exit 1 | |
| fi | |
| if [[ "${{ needs.semgrep-general.result }}" != "success" && "${{ needs.semgrep-general.result }}" != "skipped" ]]; then | |
| echo "semgrep-general did not complete successfully." | |
| exit 1 | |
| fi | |
| echo "All checks passed." |