From 2cf9d02a95fe927bae230875100f222f02c07718 Mon Sep 17 00:00:00 2001
From: Revanthathreya <143704329+Revanthathreya@users.noreply.github.com>
Date: Mon, 24 Feb 2025 14:12:54 +0530
Subject: [PATCH] SC-5143:Update semgrep.yml

---
 .github/workflows/semgrep.yml | 65 +++++++++++++++++++++++++----------
 1 file changed, 47 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 1dbeb722..019095aa 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -1,35 +1,64 @@
-name: Semgrep
+name: Semgrep Scan
 
-# Run workflow each time code is pushed to your repository.
 on:
-  push:
-    branches:
-      - main
   pull_request:
     branches:
       - main
+
 jobs:
   build:
-    runs-on: macos-latest
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write # Give write permission to PRs
+      issues: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
 
-      - name: Install Semgrep
-        run: pip install semgrep
+      - name: Install Semgrep and jq
+        run: |
+          sudo apt install python3-venv jq
+          python3 -m venv .venv
+          .venv/bin/pip install semgrep
 
       - name: Run Semgrep
         run: |
-          semgrep --config .semgreprules/customRule.yml --config auto --severity ERROR --sarif . > results.sarif
+          source .venv/bin/activate
+          semgrep --config auto --severity ERROR --json-output=results.json --no-error
+          cat results.json | jq .results > pretty-results.json
 
-      - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v3
+      - name: Display Raw Semgrep JSON Output
+        run: |
+         echo "Displaying raw Semgrep results..."
+         cat pretty-results.json
+         
+      - name: Add comment on PR if findings are found
+        uses: actions/github-script@v6
         with:
-          # Path to SARIF file relative to the root of the repository
-          sarif_file: results.sarif
+          script: |
+            // Ensure the context has a pull_request
+            if (context.payload.pull_request) {
+              const prNumber = context.payload.pull_request.number;
+              const fs = require('fs');
+              const results = JSON.parse(fs.readFileSync('pretty-results.json', 'utf8'));
+              const highFindings = results.filter(result => result.extra && result.extra.severity === 'ERROR');
 
-      - name: Upload results
-        uses: actions/upload-artifact@v4
-        with:
-          name: semgrep-results
-          path: results.sarif
+              // Comment if findings exist
+              if (highFindings.length > 0) {
+                const comment = `**Semgrep Findings:** Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.`;
+                await github.rest.issues.createComment({
+                  ...context.repo,
+                  issue_number: prNumber,
+                  body: comment
+                });
+              } else {
+                const noIssuesComment = "**Semgrep findings:** No issues found, Good to merge.";
+                await github.rest.issues.createComment({
+                  ...context.repo,
+                  issue_number: prNumber,
+                  body: noIssuesComment
+                });
+              }
+            } else {
+              console.log("This workflow wasn't triggered by a pull request, so no comment will be added.");
+            }