{
  "output": "name: Semgrep\npermissions:\n  contents: read\n\non:\n  push:\n    branches: [ \"master\" ]\n  pull_request:\n    branches: [ \"master\" ]\n  schedule:\n    - cron: '16 7 * * 4'\n  workflow_dispatch:\n\nconcurrency:\n  group: semgrep-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  semgrep:\n    name: Semgrep Scan\n    runs-on: ubuntu-latest\n    container:\n      image: semgrep/semgrep:1.161.0\n    if: (github.actor != 'dependabot[bot]')\n    steps:\n      - name: Checkout code\n        uses: actions/checkout@v4\n\n      - name: Run Semgrep\n        shell: bash\n        run: |\n          semgrep ci --sarif --output=semgrep.sarif --config=p/default --config=p/kotlin --config=p/owasp-top-ten\n          status=$?\n          if [ \"$status\" -ne 0 ] && [ \"$status\" -ne 1 ]; then\n            exit \"$status\"\n          fi\n          exit 0\n\n      - name: Upload SARIF artifact\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: semgrep-sarif\n          path: semgrep.sarif\n          if-no-files-found: warn\n          retention-days: 30\n"
}