static-analysis.yml

---
.static-analysis:
  variables:
    SEMGREP_SEND_METRICS: "off"
    SEMGREP_TIMEOUT: "900"
  image:
    name: returntocorp/semgrep:1.74.0
    entrypoint: [""]
  script:
    - semgrep --disable-version-check --version
    - >-
      semgrep
      --error
      --disable-version-check
      --metrics="off"
      --severity="ERROR"
      --severity="WARNING"
      --exclude=".git/"
      --exclude="build/"
      --exclude="dist/"
      --exclude="node_modules/"
      --exclude="test/"
      --exclude="tests/"
      --exclude="vendor/"
      --config="p/ci"
      --config="p/command-injection"
      --config="p/headless-browser"
      --config="p/insecure-transport"
      --config="p/jwt"
      --config="p/mobsfscan"
      --config="p/owasp-top-ten"
      --config="p/r2c"
      --config="p/r2c-bug-scan"
      --config="p/r2c-ci"
      --config="p/r2c-security-audit"
      --config="p/secrets"
      --config="p/security-audit"
      --config="p/sql-injection"
      --config="p/trailofbits"
      --config="p/xss"
      --config="p/java"
      --config="p/react"
      --config="p/golang"
      --config="p/kotlin"
      --config="p/nodejs"
      --config="p/python"
      --config="p/expressjs"
      --config="p/nodejsscan"
      --config="p/typescript"
      --config="p/javascript"
      --config="p/clientside-js"
      --config="p/eslint-plugin-security"
      $(pwd)
  tags:
    - miquido
    - docker