Add semgrep

.circleci/config.yml

@@ -147,6 +147,15 @@ jobs:
       - setup-bundler
       - run: bundle exec brakeman
 
+  semgrep:
+    docker:
+        - image: returntocorp/semgrep
+    steps:
+      - checkout
+      - run:
+          name: Check code against community-provided and custom semgrep rules
+          command: semgrep ci --config auto
+
   bearer:
     docker:
       - image: cimg/ruby:3.2
@@ -163,6 +172,7 @@ workflows:
     jobs:
       - bearer
       - build
+      - semgrep
       - rubocop:
          requires:
           - build

.semgrepignore

@@ -0,0 +1,19 @@
+# Common large paths
+node_modules/
+vendor/
+*.min.js
+spec/
+
+# Semgrep rules folder
+.semgrep
+
+# Semgrep-action log folder
+.semgrep_logs/
+
+# Tickets to remediate these rules and remove from this list
+config/
+# https://github.com/pulibrary/lib_jobs/issues/847
+app/models/
+# https://github.com/pulibrary/lib_jobs/issues/848
+app/controllers/
+# https://github.com/pulibrary/lib_jobs/issues/849