codeql.yml

name: Semgrep

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 3 * * 1'  # Every Monday at 03:00 UTC

jobs:
  scan:
    name: Scan PHP
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Semgrep
        run: pip install semgrep

      - name: Run Semgrep
        run: |
          semgrep \
            --config=p/php \
            --config=p/wordpress \
            --sarif \
            --output=semgrep.sarif \
            . || true

      - name: Upload SARIF to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: semgrep.sarif