ci: add semgrep check (#477)

Author: venikkin

.teamcity/builds/Build.kt

@@ -38,6 +38,8 @@ class Build(
             if (forPullRequests) dependentBuildType(PRCheck("${name}-pr-check", "pr check"))
 
             parallel {
+              dependentBuildType(SemgrepCheck("${name}-semgrep-check", "semgrep check"))
+
               JavaPlatform.entries.forEach { java ->
                 val packaging =
                     Maven(

.teamcity/builds/Common.kt

@@ -33,6 +33,11 @@ val MAVEN_DEFAULT_ARGS = buildString {
 }
 const val DEFAULT_BRANCH = "main"
 
+const val FULL_GITHUB_REPOSITORY = "$GITHUB_OWNER/$GITHUB_REPOSITORY"
+const val GITHUB_URL = "https://github.com/$FULL_GITHUB_REPOSITORY"
+
+const val SEMGREP_DOCKER_IMAGE = "semgrep/semgrep:1.146.0"
+
 val DEFAULT_JAVA_VERSION = JavaVersion.V_11
 const val DEFAULT_CONFLUENT_PLATFORM_VERSION = "7.2.9"
 

.teamcity/builds/Maven.kt

@@ -3,7 +3,7 @@ package builds
 import jetbrains.buildServer.configs.kotlin.BuildType
 import jetbrains.buildServer.configs.kotlin.toId
 
-class Maven(
+open class Maven(
     id: String,
     name: String,
     goals: String,

.teamcity/builds/SemgrepCheck.kt

@@ -0,0 +1,35 @@
+package builds
+
+import jetbrains.buildServer.configs.kotlin.buildSteps.ScriptBuildStep
+
+class SemgrepCheck(
+  id: String,
+  name: String
+): Maven(
+    id,
+    name,
+    "dependency:tree",
+    JavaVersion.V_17,
+    Neo4jVersion.V_NONE,
+    "-DoutputFile=maven_dep_tree.txt"
+) {
+
+  init {
+
+    params.password("env.SEMGREP_APP_TOKEN", "%semgrep-app-token%")
+    params.text("env.SEMGREP_REPO_NAME", FULL_GITHUB_REPOSITORY)
+    params.text("env.SEMGREP_REPO_URL", GITHUB_URL)
+    params.text("env.SEMGREP_BRANCH", "%teamcity.build.branch%")
+    params.text("env.SEMGREP_JOB_URL", "%env.BUILD_URL%")
+    params.text("env.SEMGREP_COMMIT", "%env.BUILD_VCS_NUMBER%")
+
+    steps.step(ScriptBuildStep {
+      scriptContent="semgrep ci --no-git-ignore"
+      dockerImagePlatform = ScriptBuildStep.ImagePlatform.Linux
+      dockerImage = SEMGREP_DOCKER_IMAGE
+      dockerRunParameters =
+          "--volume /var/run/docker.sock:/var/run/docker.sock --volume %teamcity.build.checkoutDir%/signingkeysandbox:/root/.gnupg"
+    })
+  }
+
+}

.teamcity/settings.kts

@@ -14,6 +14,7 @@ project {
   params {
     password("github-commit-status-token", "%github-token%")
     password("github-pull-request-token", "%github-token%")
+    password("semgrep-app-token", "%semgrep-token%")
   }
 
   vcsRoot(Neo4jKafkaConnectorVcs)