Repository navigation
ci(security): report-only weekly Semgrep in the reusable scan (v1.1.0) - #12
Merged
Merged
Conversation
… (v1.1.0) New optional inputs semgrep (default false) and semgrep-config (default p/default). The job runs on the caller's runner spec, is continue-on-error, never fails the run and is not part of the gate, so release gating is unchanged. Results go to the job summary (no matched source lines); Slack is posted only for High (ERROR) findings and never on PRs. semgrep 1.182.1 runs through uv 0.13.6 (SHA256 verified, tool cache). The gate is skipped when a call enables none of the gated scanners (semgrep-only callers). Existing callers are unaffected (all new inputs default off). Signed-off-by: Joe Blau <im@joeblau.com>
…t + zizmor clean) Signed-off-by: Joe Blau <im@joeblau.com>
Signed-off-by: Joe Blau <im@joeblau.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an opt-in, report-only Semgrep job to
security-scan.yml, to be tagged v1.1.0 after merge (v1 / v1.0.x tags are not moved).semgrep(defaultfalse) andsemgrep-config(defaultp/default). Existing callers are unaffected.semgrepjob:continue-on-error, every step exits 0, not agatedependency, so it never fails or gates. Semgrep 1.182.1 via uv 0.13.6 (SHA-256 verified, tool cache),--metrics=off.ERROR) findings, not on PRs.gatenow runs only when deps/secrets/iac/workflow-lint is enabled, so a Semgrep-only weekly caller has no empty gate.enforce-workflow-lint: true(actionlint 1.7.12 + zizmor 1.31.1 medium+ are clean) and it re-runs on workflow changes.Local check:
semgrep scan --config p/defaulton bloxwap/chart took 13 s: 12 WARNING, 0 ERROR, 0 scan errors.