Azure DevOps Semgrep pipeline

semgrep.yml

# Create a branch policy in Azure Repos to protect your main branch
trigger: none

schedules:
  - cron: "28 5 * * 6"
    displayName: "Weekly run"
    branches:
      include: ["main", "master"]
    always: true

jobs:
  - job: Semgrep
    displayName: Semgrep scan
    pool: TheAdoAgentPoolName
    timeoutInMinutes: 10
    workspace:
      clean: all

    variables:
      ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
        fetchDepth: 0
      ${{ else }}:
        fetchDepth: 1

    steps:
      - checkout: self
        clean: true
        fetchDepth: ${{ variables.fetchDepth }}

      - script: python3 -m pip install semgrep
        displayName: Install semgrep

      - script: |
          targetBranchCommitId=$(git rev-parse origin/$SYSTEM_PULLREQUEST_TARGETBRANCHNAME)
          semgrep scan --config=auto --error --time --verbose --baseline-commit $targetBranchCommitId
        condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
        displayName: Pull request scan

      - script: semgrep scan --config=auto --error --time --verbose
        condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'))
        displayName: Full scan