{{- define "template.scan-semgrep" -}}
- name: scan-semgrep
  inputs:
    parameters:
      - name: working-dir
  container:
    image: {{ .Values.images.semgrep | quote }}
    command:
      - sh
      - -c
    args:
      - |
        set -eu
        mkdir -p /workspace/reports
        semgrep scan --config auto --sarif --output /workspace/reports/semgrep.sarif "/workspace/{{ `{{inputs.parameters.working-dir}}` }}" || true
    volumeMounts:
      - name: workspace
        mountPath: /workspace
{{- end }}