Skip to content

Configure staging env workflows #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
IsaacBell merged 4 commits into from
Sep 5, 2026
Merged

Configure staging env workflows #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
110afc5
fix: remove persistent semgrep setup artifacts
IsaacBell Sep 4, 2026
9f07717
staging config
IsaacBell Sep 5, 2026
5cc4fc9
un-revert sarif upload changes
IsaacBell Sep 5, 2026
d130ee3
history cleanup
IsaacBell Sep 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/codeant.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ jobs:
codeant_scan:
name: Run CodeAnt CI scan
runs-on: ubuntu-latest
environment: staging
if: ${{ vars.CODEANT_ENABLED == 'true' }}
steps:
- name: Checkout code
Expand Down
2 changes: 1 addition & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
.env.*
!.env.example

.sarif
*.sarif

*node_modules/
coverage/
Expand Down
3 changes: 1 addition & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
# Secure Devtools

Dev-time security tools for detecting compromised code, dependencies, and supply-chain
risks — designed to run locally and in CI, and to be small enough to audit.
Dev-time security tools for detecting compromised code, dependencies, and supply-chain risks — designed to run locally and in CI, and to be small enough to audit.

> **Zero npm runtime dependencies.** The shipped tools are plain shell — there is no dependency tree to audit at
> install time. `am-i-compromised` needs only `bash`, `ripgrep`, and `jq`; `secure-semgrep` also
Expand Down
5 changes: 2 additions & 3 deletions mise.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,14 +5,13 @@ shellcheck = "latest"
shfmt = "latest"
ripgrep = "latest"
jq = "latest"
trivy = "latest"
# trivy = "latest"
semgrep = "latest"
snyk = "latest"

[settings]
minimum_release_age = "7d"
# pnpm and trivy cut releases frequently enough that the 7d window is not useful.
minimum_release_age_excludes = ["pnpm", "trivy"]
minimum_release_age_excludes = ["pnpm"]

@codeant-ai codeant-ai Bot Sep 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Excluding pnpm bypasses the seven-day release delay, allowing a newly published matching version to enter local and CI toolchains immediately. [security]

Assessment: 🟠 Major · 🔁 Occurrence: Rarely

Use CodeAnt Skill Fix in Cursor Fix in VSCode Claude

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** mise.toml
**Line:** 14:14
**Comment:**
	*Security: Excluding `pnpm` bypasses the seven-day release delay, allowing a newly published matching version to enter local and CI toolchains immediately.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎


# Tasks are thin aliases over the canonical pnpm scripts (package.json) so
# devs, git hooks, and CI all share one interface. Run with: mise run <task>
Expand Down
Loading