generic.ci.audit.changed-semgrepignore.changed-semgrepignore

rules:
  - id: changed-semgrepignore
    paths:
      include:
        - .semgrepignore
    patterns:
      - pattern-regex: |
          ^(.*)$
      - pattern-not-regex: |
          ^\n.*$
      - pattern-not-regex: |
          ^#.*$
    message: "`$1` has been added to the .semgrepignore list of ignored paths.
      Someone from app-sec may want to audit these changes."
    languages:
      - generic
    severity: WARNING
    metadata:
      technology:
        - semgrep
      references:
        - https://semgrep.dev/docs/ignoring-files-folders-code/
      category: best-practice
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]