From 110afc5027f95c697b12d715adcbe6f7afa86211 Mon Sep 17 00:00:00 2001 From: Isaac Bell Date: Fri, 4 Sep 2026 15:31:01 -0400 Subject: [PATCH 1/4] fix: remove persistent semgrep setup artifacts --- .github/workflows/codeant.yml | 1 + .github/workflows/semgrep.yml | 26 ++++++++------------------ .gitignore | 2 -- mise.toml | 10 ---------- 4 files changed, 9 insertions(+), 30 deletions(-) diff --git a/.github/workflows/codeant.yml b/.github/workflows/codeant.yml index e6e3c71..a5f67b9 100644 --- a/.github/workflows/codeant.yml +++ b/.github/workflows/codeant.yml @@ -14,6 +14,7 @@ jobs: codeant_scan: name: Run CodeAnt CI scan runs-on: ubuntu-latest + environment: staging if: ${{ vars.CODEANT_ENABLED == 'true' }} steps: - name: Checkout code diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index b077158..bd6b5b9 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -10,7 +10,6 @@ on: permissions: contents: read - security-events: write jobs: semgrep: @@ -18,25 +17,16 @@ jobs: runs-on: ubuntu-latest container: image: semgrep/semgrep - steps: - name: Checkout code uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - name: Run Semgrep - id: semgrep - continue-on-error: true - run: | - semgrep scan \ - --config apps/secure-semgrep/rules \ - --config p/default \ - --config p/security-audit \ - --sarif \ - --output=semgrep.sarif + # Scan this repository with the bundled secure-semgrep rules + Node/Python + # loadouts. Review mode (-e) records findings as evidence without breaking + # CI; run `mise run semgrep-strict` locally to enforce them as a gate. + - name: Run Semgrep (secure-semgrep) + run: bash apps/secure-semgrep/bin/secure-semgrep.sh -e -L node -L py . - - name: Upload SARIF - # if fork PR, don't upload their SARIF - if: steps.semgrep.outcome == 'success' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) - uses: github/codeql-action/upload-sarif@9fddc16f0de775b9edd8a84dd5839ac2db070f8b - with: - sarif_file: semgrep.sarif + # Keep the bundled rules honest: fail the build if any rule stops parsing. + - name: Validate bundled rules + run: semgrep scan --config apps/secure-semgrep/rules --validate diff --git a/.gitignore b/.gitignore index 316dd22..04794f8 100644 --- a/.gitignore +++ b/.gitignore @@ -2,8 +2,6 @@ .env.* !.env.example -.sarif - *node_modules/ coverage/ *dist/ diff --git a/mise.toml b/mise.toml index 9248e16..867cfe1 100644 --- a/mise.toml +++ b/mise.toml @@ -7,7 +7,6 @@ ripgrep = "latest" jq = "latest" trivy = "latest" semgrep = "latest" -snyk = "latest" [settings] minimum_release_age = "7d" @@ -44,12 +43,6 @@ run = "pnpm -r --if-present format" description = "Verify shell sources are shfmt-clean" run = "pnpm -r --if-present format:check" -[tasks.snyk-scan-deps] -run = "snyk test --all-projects" - -[tasks.snyk-code-scan] -run = "snyk code test --all-projects" - [tasks.semgrep] # Full static-analysis pass over this repository (evidence mode: exits 0 so a # scan that finds issues still produces a report instead of breaking CI). @@ -61,9 +54,6 @@ run = "bash apps/secure-semgrep/bin/secure-semgrep.sh -e -L node -L py ." description = "Run secure-semgrep over the repo; exit 1 on any finding (gate)" run = "bash apps/secure-semgrep/bin/secure-semgrep.sh -L node -L py ." -[tasks.semgrep-ci] -run = "semgrep scan --config apps/secure-semgrep/rules --config p/default --config p/security-audit --sarif --output=semgrep.sarif" - [tasks.semgrep-check] description = "Validate every bundled secure-semgrep rule parses" dir = "apps/secure-semgrep" From 9f077177d911c131183082f3db722e04a92a6ed2 Mon Sep 17 00:00:00 2001 From: Isaac Bell Date: Sat, 5 Sep 2026 12:54:01 -0400 Subject: [PATCH 2/4] staging config --- README.md | 3 +-- mise.toml | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index dc1569e..b6e1970 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,6 @@ # Secure Devtools -Dev-time security tools for detecting compromised code, dependencies, and supply-chain -risks — designed to run locally and in CI, and to be small enough to audit. +Dev-time security tools for detecting compromised code, dependencies, and supply-chain risks — designed to run locally and in CI, and to be small enough to audit. > **Zero npm runtime dependencies.** The shipped tools are plain shell — there is no dependency tree to audit at > install time. `am-i-compromised` needs only `bash`, `ripgrep`, and `jq`; `secure-semgrep` also diff --git a/mise.toml b/mise.toml index 867cfe1..a814622 100644 --- a/mise.toml +++ b/mise.toml @@ -5,13 +5,13 @@ shellcheck = "latest" shfmt = "latest" ripgrep = "latest" jq = "latest" -trivy = "latest" +# trivy = "latest" semgrep = "latest" [settings] minimum_release_age = "7d" # pnpm and trivy cut releases frequently enough that the 7d window is not useful. -minimum_release_age_excludes = ["pnpm", "trivy"] +minimum_release_age_excludes = ["pnpm"] # Tasks are thin aliases over the canonical pnpm scripts (package.json) so # devs, git hooks, and CI all share one interface. Run with: mise run From 5cc4fc95f8a2b2177659706d6098ef9cdb7e4d6d Mon Sep 17 00:00:00 2001 From: Isaac Bell Date: Sat, 5 Sep 2026 12:55:53 -0400 Subject: [PATCH 3/4] un-revert sarif upload changes --- .github/workflows/semgrep.yml | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index bd6b5b9..b077158 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -10,6 +10,7 @@ on: permissions: contents: read + security-events: write jobs: semgrep: @@ -17,16 +18,25 @@ jobs: runs-on: ubuntu-latest container: image: semgrep/semgrep + steps: - name: Checkout code uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - # Scan this repository with the bundled secure-semgrep rules + Node/Python - # loadouts. Review mode (-e) records findings as evidence without breaking - # CI; run `mise run semgrep-strict` locally to enforce them as a gate. - - name: Run Semgrep (secure-semgrep) - run: bash apps/secure-semgrep/bin/secure-semgrep.sh -e -L node -L py . + - name: Run Semgrep + id: semgrep + continue-on-error: true + run: | + semgrep scan \ + --config apps/secure-semgrep/rules \ + --config p/default \ + --config p/security-audit \ + --sarif \ + --output=semgrep.sarif - # Keep the bundled rules honest: fail the build if any rule stops parsing. - - name: Validate bundled rules - run: semgrep scan --config apps/secure-semgrep/rules --validate + - name: Upload SARIF + # if fork PR, don't upload their SARIF + if: steps.semgrep.outcome == 'success' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) + uses: github/codeql-action/upload-sarif@9fddc16f0de775b9edd8a84dd5839ac2db070f8b + with: + sarif_file: semgrep.sarif From d130ee35bd8c67d2c74d3e912f04d376e2f49a84 Mon Sep 17 00:00:00 2001 From: Isaac Bell Date: Sat, 5 Sep 2026 12:58:51 -0400 Subject: [PATCH 4/4] history cleanup --- .gitignore | 2 ++ mise.toml | 9 +++++++++ 2 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index 04794f8..44217f2 100644 --- a/.gitignore +++ b/.gitignore @@ -2,6 +2,8 @@ .env.* !.env.example +*.sarif + *node_modules/ coverage/ *dist/ diff --git a/mise.toml b/mise.toml index a814622..7bbef39 100644 --- a/mise.toml +++ b/mise.toml @@ -43,6 +43,12 @@ run = "pnpm -r --if-present format" description = "Verify shell sources are shfmt-clean" run = "pnpm -r --if-present format:check" +[tasks.snyk-scan-deps] +run = "snyk test --all-projects" + +[tasks.snyk-code-scan] +run = "snyk code test --all-projects" + [tasks.semgrep] # Full static-analysis pass over this repository (evidence mode: exits 0 so a # scan that finds issues still produces a report instead of breaking CI). @@ -54,6 +60,9 @@ run = "bash apps/secure-semgrep/bin/secure-semgrep.sh -e -L node -L py ." description = "Run secure-semgrep over the repo; exit 1 on any finding (gate)" run = "bash apps/secure-semgrep/bin/secure-semgrep.sh -L node -L py ." +[tasks.semgrep-ci] +run = "semgrep scan --config apps/secure-semgrep/rules --config p/default --config p/security-audit --sarif --output=semgrep.sarif" + [tasks.semgrep-check] description = "Validate every bundled secure-semgrep rule parses" dir = "apps/secure-semgrep"