name: Semgrep

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  workflow_dispatch: {}
  schedule:
    - cron: '0 14 * * 2'

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: read
  security-events: write

jobs:
  semgrep:
    # https://github.com/42ByteLabs/.github/blob/main/.github/workflows/semgrep.yml
    uses: 42ByteLabs/.github/.github/workflows/semgrep.yml@main
    secrets: inherit
