Merge pull request #62 from advanced-security/opengrep-latest

sec-opengrep.yml to pull latest

Author: felickz

.github/workflows/language-detection-and-assignment.yml

@@ -1,11 +1,11 @@
 name: Language Detection and Assignment
 
 on:
-  pull_request:
-    branches: [main]
-
+  workflow_call:
+permissions: 
+  pull-requests: write 
 env:
-  GH_TOKEN: ${{ secrets.GH_AP_TOKEN }}
+  GH_TOKEN: ${{ github.token }}
 jobs:
   detect-and-assign:
     runs-on: ubuntu-latest
@@ -45,4 +45,4 @@ jobs:
       - name: Assign default
         if: steps.detect-languages.outputs.java != 'true' && steps.detect-languages.outputs.kotlin != 'true' && steps.detect-languages.outputs.javascript != 'true' && steps.detect-languages.outputs.typescript != 'true' && steps.detect-languages.outputs.go != 'true'  && steps.detect-languages.outputs.codeql != 'true' && steps.detect-languages.outputs.python != 'true'  
         run: |
-          gh pr edit ${{ github.event.number }} --add-reviewer felickz --add-reviewer Geekmasher --add-reviewer adrienpessu
+          gh pr edit ${{ github.event.number }} --add-reviewer felickz --add-reviewer felickz --add-reviewer adrienpessu --repo $GITHUB_REPOSITORY 

.github/workflows/sec-opengrep.yml

@@ -12,11 +12,6 @@ permissions:
   actions: read
   security-events: write
 
-env:
-  # Release version of Opengrep
-  # https://github.com/opengrep/opengrep/releases
-  RELEASE_VERSION: v1.1.2
-
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -27,16 +22,21 @@ jobs:
       - name: "Download / Install Opengrep"
         run: |
           set -e
-
-          echo "[+] Downloading Opengrep"
-          curl -sSfL \
-            -o "/usr/local/bin/opengrep" \
-            "https://github.com/opengrep/opengrep/releases/download/${RELEASE_VERSION}/opengrep_manylinux_x86"
+          echo "[+] Fetching latest Opengrep release information"
+          API_URL="https://api.github.com/repos/opengrep/opengrep/releases/latest"
+          ASSET_NAME="opengrep_manylinux_x86"
+          DOWNLOAD_URL=$(curl -s $API_URL | jq -r ".assets[] | select(.name==\"${ASSET_NAME}\") | .browser_download_url")
+          if [ -z "$DOWNLOAD_URL" ] || [ "$DOWNLOAD_URL" = "null" ]; then
+            echo "Could not find download URL for $ASSET_NAME"
+            exit 1
+          fi
+          echo "[+] Downloading Opengrep from $DOWNLOAD_URL"
+          curl -sSfL -o "/usr/local/bin/opengrep" "$DOWNLOAD_URL"
           chmod +x /usr/local/bin/opengrep
           echo "[+] Finished installing opengrep"
-
+    
       - name: "Run Opengrep"
-        run: opengrep scan --metrics=on --sarif-output ./results.sarif .
+        run: opengrep scan --sarif-output ./results.sarif .
 
       - name: "Upload SARIF file"
         uses: github/codeql-action/upload-sarif@v3