Repository navigation
docs(ramp): add locations, entities, transfers, and statements tables #24034
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| on: | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| name: Security | |
| permissions: | |
| contents: read | |
| env: | |
| SEMGREP_ENABLE_VERSION_CHECK: 'false' | |
| jobs: | |
| semgrep-js: | |
| runs-on: ubuntu-latest | |
| container: | |
| image: semgrep/semgrep:1.163.0@sha256:7cad2bc2d1e44f87f0bf4be6d1fa23aa90fb72015bebc89fb91385d813987a03 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # exclude react-markdown rule: we use rehypeSanitize to sanitize HTML output | |
| - name: Run Semgrep | |
| run: | | |
| semgrep \ | |
| --config "p/javascript" \ | |
| --config "p/owasp-top-ten" \ | |
| --config "p/security-audit" \ | |
| --config "p/trailofbits" \ | |
| --exclude-rule typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html \ | |
| --error \ | |
| --metrics=off \ | |
| --verbose \ | |
| src/ gatsby/ plugins/ api/ *.js *.ts *.tsx | |
| # scans GitHub Actions and other repo-wide config | |
| semgrep-general: | |
| runs-on: ubuntu-latest | |
| container: | |
| image: semgrep/semgrep:1.163.0@sha256:7cad2bc2d1e44f87f0bf4be6d1fa23aa90fb72015bebc89fb91385d813987a03 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # exclude all directories already scanned by other jobs | |
| - name: Run Semgrep | |
| run: | | |
| semgrep \ | |
| --config "p/owasp-top-ten" \ | |
| --config "p/security-audit" \ | |
| --config "p/trailofbits" \ | |
| --config "p/github-actions" \ | |
| --error \ | |
| --metrics=off \ | |
| --verbose \ | |
| --exclude ./src/ \ | |
| --exclude ./gatsby/ \ | |
| --exclude ./plugins/ \ | |
| --exclude ./api/ \ | |
| --exclude ./contents/ \ | |
| . | |
| semgrep_checks: | |
| needs: [semgrep-js, semgrep-general] | |
| name: Semgrep Checks Pass | |
| runs-on: ubuntu-latest | |
| if: always() | |
| steps: | |
| - name: Check matrix outcome | |
| run: | | |
| if [[ "${{ needs.semgrep-js.result }}" != "success" && "${{ needs.semgrep-js.result }}" != "skipped" ]]; then | |
| echo "semgrep-js did not complete successfully." | |
| exit 1 | |
| fi | |
| if [[ "${{ needs.semgrep-general.result }}" != "success" && "${{ needs.semgrep-general.result }}" != "skipped" ]]; then | |
| echo "semgrep-general did not complete successfully." | |
| exit 1 | |
| fi | |
| echo "All checks passed." |