ci(semgrep): disable flaky p/ci gha-curl-pipe-shell rule#356
Merged
Conversation
Cre-eD
requested review from
Laboratory,
smecsia and
universe-ops
as code owners
Semgrep Scan ResultsRepository:
Scanned at 2026-07-01 06:38 UTC |
📊 Statement coverageMeasured on the documented included set (see
Baseline: |
Security Scan ResultsRepository:
Scanned at 2026-07-01 06:39 UTC |
smecsia
previously approved these changes
Jun 30, 2026
universe-ops
previously approved these changes
Jun 30, 2026
The p/ci rule yaml.github-actions.security.gha-curl-pipe-shell re-parses
each workflow run: block as Bash via a metavariable-pattern. GitHub
Actions ${{ }} expressions are not valid Bash, so the sub-parser emits
nondeterministic PartialParsing / Internal matching error engine errors
(24 on our workflows) that the scan action counts in .errors and fails
on - flaky red CI, not real findings. The same commit passed then failed
on consecutive runs (#355), and main went red post-merge for the same
reason.
Suppress it via the disabled-rules input. No coverage lost: the SC
shell-curl-pipe-to-shell rule already flags curl|wget | sh piping in
**/*.yml and **/*.yaml by regex, with no Bash sub-parse.
Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
Cre-eD
force-pushed
the
fix/semgrep-disable-flaky-gha-curl-pipe-shell
branch
from
5292ce6 to
2bd9197
Compare
smecsia
approved these changes
Jul 1, 2026
universe-ops
approved these changes
Jul 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Semgrep check is flaky-red on PRs and went red on
mainafter #355 merged. Root cause is thep/ciregistry ruleyaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell.That rule re-parses every workflow
run:block as Bash via ametavariable-pattern. GitHub Actions${{ }}expressions are not valid Bash, so the sub-parser throws — emittingPartialParsing+Internal matching errorentries into the results JSON (24 on our workflows). The scan action treats a non-empty.errorsarray as a hard failure, so the build fails even though zero real findings were produced.It's nondeterministic: the same commit on
feat/provision-skip-refreshpassed in run 28464481418 and then failed in run 28464579912. After #355 squash-merged, the post-mergemainrun 28469227229 failed for the same reason.Fix
Add the rule to the existing
disabled-rulesinput (the documented knob for over-broad registry-pack rules).Why no coverage is lost
The SC custom ruleset already ships
shell-curl-pipe-to-shell(semgrep-scan/rules/shell.yml), an ERROR-severity regex rule that flagscurl|wget … | shsupply-chain piping across**/*.sh,**/*.bash,**/*.yml,**/*.yaml— with no Bash sub-parse, so it can't hit this engine bug. The registry rule is redundant with it.Empirical verification
Pinned image
semgrep/semgrep:1.161.0against.github/workflows:.errorsp/ci(rule active)p/ci+--exclude-rule …gha-curl-pipe-shellAll 24 CI errors traced to this single rule (
23× PartialParsing + Internal matching error, no other rule implicated).