Changed pull_request_target to pull_request #704

	name: Semgrep

	on:
	merge_group:
	pull_request:
	types:
	- opened
	- synchronize
	push:
	branches:
	- main
	schedule:
	- cron: "30 0 1,15 * *"

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

	jobs:
	run:
	name: Check for Vulnerabilities
	runs-on: ubuntu-latest
	container:
	image: returntocorp/semgrep

	steps:
	- if: github.actor == 'dependabot[bot]' \|\| github.event_name == 'merge_group'
	run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.

	- name: Checkout Code
	uses: actions/checkout@v4
	with:
	ref: ${{ github.event.pull_request.head.sha \|\| github.ref }}

	- if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
	name: Run Semgrep for internal PRs
	run: semgrep ci
	env:
	SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_TOKEN }}

	- if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
	name: Skip Semgrep for external PRs
	run: echo "Skipping Semgrep for external PRs as secrets are not available"

Provide feedback