name: SAST

on:
  pull_request: {}
  push:
    branches:
      - develop
      - release/*
  workflow_dispatch: {}

permissions: {}

jobs:
  semgrep:
    timeout-minutes: 5
    name: Semgrep SAST
    runs-on: ubuntu-24.04
    permissions:
      security-events: write

    if: (github.actor != 'dependabot[bot]')

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: Kong/public-shared-actions/security-actions/semgrep@a18abf762d6e2444bcbfd20de70451ea1e3bc1b1 # 4.0.1