security-checks.yml

name: "Static analysis checks for security vulnerabilities"
on:
  workflow_call:
    inputs:
      base_branch:
        required: true
        type: string

jobs:
  run-semgrep:
    name: "Run Semgrep to find vulnerabilities and security antipatterns"
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep-action
    if: |
      github.actor != 'dependabot[bot]'
    steps:
      - name: "Checkout this branch"
        uses: actions/checkout@v6

      - name: "Checkout base branch"
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.inputs.base_branch }}

      - name: "Determine which Semgrep config(s) to use"
        run: |
          REPO_NAME=${{ github.event.repository.name }}

          if [[ $REPO_NAME =~ "android" ]]; then
              SEMGREP_RULES="p/java p/kotlin p/javascript r/bash r/yaml"
          elif [[ $REPO_NAME =~ "apple" ]]; then
              SEMGREP_RULES="p/ci p/javascript p/ruby r/bash r/yaml"
          elif [[ $REPO_NAME =~ "web" || $REPO_NAME =~ "node" ]]; then
              SEMGREP_RULES="p/javascript p/typescript"
          else
              SEMGREP_RULES="auto"
          fi

          echo "SEMGREP_RULES=$SEMGREP_RULES" >> $GITHUB_ENV
          echo "Setting SEMGREP_RULES to \'$SEMGREP_RULES\'"

      - name: "Run Semgrep"
        run: "semgrep ci"
        env:
          SEMGREP_RULES: ${{ env.SEMGREP_RULES }}
          SEMGREP_BASELINE_REF: ${{ github.event.inputs.base_branch }}  # enables diff-aware scans

  run-mobsfscan:
    name: "Run mobsfscan to find Android/iOS vulnerabilities and misconfigurations"
    runs-on: ubuntu-latest
    if: |
      github.actor != 'dependabot[bot]' &&
      ( contains(github.event.repository.name, 'android') || contains(github.event.repository.name, 'apple'))
    steps:
      - name: "Checkout repository"
        uses: actions/checkout@v6

      - name: "Run mobsfscan"
        uses: MobSF/mobsfscan@main
        with:
          args: '. --sonarqube'