Repository navigation

Add benchmark coverage for every parameter set, ECC curve and RSA key size the build supports #617

	name: Semgrep

	on:
	push:
	branches: [ 'master', 'main', 'release/**' ]
	pull_request:
	branches: [ '*' ]
	types: [opened, synchronize, reopened, ready_for_review]

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	semgrep:
	name: Semgrep (wolfTPM security rules)
	if: github.event_name != 'pull_request' \|\| github.event.pull_request.draft == false
	runs-on: ubuntu-latest
	container:
	image: ghcr.io/wolfssl/wolftpm-ci:v1.1
	defaults:
	run:
	shell: bash
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@v4
	with:
	submodules: true

	# Pin Semgrep so the gate is deterministic: a future release cannot
	# change rule behavior or fail the build out from under a PR.

	# --error makes the job fail on any finding. The rules self-scope via
	# their `paths:` blocks, so scanning the whole tree is fine.
	- name: Run wolfTPM security rules
	run: semgrep scan --config .github/semgrep-rules.yml --error --quiet .