Skip to content

config: add sarif output to semgrep workflow for CodeQL output #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
IsaacBell merged 12 commits into from
Sep 4, 2026
Merged

config: add sarif output to semgrep workflow for CodeQL output #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
39c59e6
feat: add trivy + semgrep
IsaacBell Sep 4, 2026
1aafb3e
feat: add semgrep rules, scripts
IsaacBell Sep 4, 2026
172a9a3
Merge branch 'main' of https://github.com/IsaacBell/secure-devtools
IsaacBell Sep 4, 2026
a3f4012
hotfix: merge conflict artifact
IsaacBell Sep 4, 2026
5b38a97
Merge branch 'main' of https://github.com/IsaacBell/secure-devtools
IsaacBell Sep 4, 2026
a6ffa57
config: add sarif output to semgrep workflow for CodeQL output
IsaacBell Sep 4, 2026
7da470e
fix: remove semgrep's example rule trigger files
IsaacBell Sep 4, 2026
2c7898a
fix: sha in codeql link
IsaacBell Sep 4, 2026
d9b4255
fix: make semgrep output sarif consistently
IsaacBell Sep 4, 2026
504d2c5
fix: sarif output from semgrep scans
IsaacBell Sep 4, 2026
114bf44
fix: semgrep config corrections
IsaacBell Sep 4, 2026
ae4bf11
fix: semgrep config corrections
IsaacBell Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 18 additions & 8 deletions .github/workflows/semgrep.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,23 +10,33 @@ on:

permissions:
contents: read
security-events: write

@codeant-ai codeant-ai Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Fork-originated pull requests receive read-only tokens, so this upload requiring security-events: write fails for the pull requests this workflow also processes. [api mismatch]

Assessment: 🟠 Major · 🔁 Occurrence: Sometimes

Use CodeAnt Skill Fix in Cursor Fix in VSCode Claude

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** .github/workflows/semgrep.yml
**Line:** 13:13
**Comment:**
	*Api Mismatch: Fork-originated pull requests receive read-only tokens, so this upload requiring `security-events: write` fails for the pull requests this workflow also processes.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎


jobs:
semgrep:
name: Semgrep
runs-on: ubuntu-latest
container:
image: semgrep/semgrep

steps:
- name: Checkout code
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

# Scan this repository with the bundled secure-semgrep rules + Node/Python
# loadouts. Review mode (-e) records findings as evidence without breaking
# CI; run `mise run semgrep-strict` locally to enforce them as a gate.
- name: Run Semgrep (secure-semgrep)
run: bash apps/secure-semgrep/bin/secure-semgrep.sh -e -L node -L py .
- name: Run Semgrep
id: semgrep
continue-on-error: true
run: |
semgrep scan \
--config apps/secure-semgrep/rules \
--config p/default \
--config p/security-audit \
--sarif \
--output=semgrep.sarif

# Keep the bundled rules honest: fail the build if any rule stops parsing.
- name: Validate bundled rules
run: semgrep scan --config apps/secure-semgrep/rules --validate
- name: Upload SARIF
# if fork PR, don't upload their SARIF
if: steps.semgrep.outcome == 'success' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
uses: github/codeql-action/upload-sarif@9fddc16f0de775b9edd8a84dd5839ac2db070f8b
with:
sarif_file: semgrep.sarif
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@
.env.*
!.env.example

.sarif

*node_modules/
coverage/
*dist/
Expand Down
10 changes: 10 additions & 0 deletions mise.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ ripgrep = "latest"
jq = "latest"
trivy = "latest"
semgrep = "latest"
snyk = "latest"

[settings]
minimum_release_age = "7d"
Expand Down Expand Up @@ -43,6 +44,12 @@ run = "pnpm -r --if-present format"
description = "Verify shell sources are shfmt-clean"
run = "pnpm -r --if-present format:check"

[tasks.snyk-scan-deps]
run = "snyk test --all-projects"

[tasks.snyk-code-scan]
run = "snyk code test --all-projects"

[tasks.semgrep]
# Full static-analysis pass over this repository (evidence mode: exits 0 so a
# scan that finds issues still produces a report instead of breaking CI).
Expand All @@ -54,6 +61,9 @@ run = "bash apps/secure-semgrep/bin/secure-semgrep.sh -e -L node -L py ."
description = "Run secure-semgrep over the repo; exit 1 on any finding (gate)"
run = "bash apps/secure-semgrep/bin/secure-semgrep.sh -L node -L py ."

[tasks.semgrep-ci]
run = "semgrep scan --config apps/secure-semgrep/rules --config p/default --config p/security-audit --sarif --output=semgrep.sarif"

[tasks.semgrep-check]
description = "Validate every bundled secure-semgrep rule parses"
dir = "apps/secure-semgrep"
Expand Down
Loading