ci(security): Semgrep SAST (#32)

2026-07-04 16:01:34 +02:00
parent 074d39d9a2
commit 1e8feeef71
1 changed files with 18 additions and 0 deletions
@@ -52,3 +52,21 @@ jobs:
        # (Vite/PostCSS/etc.) shouldn't block a merge.
        working-directory: frontend
        run: npm audit --omit=dev --audit-level=high
  # RECOMMENDATIONS #9: SAST. Semgrep community rules for C#/JS + OWASP/secrets patterns —
  # catches injection/crypto-misuse classes the other gates (gitleaks, dep-audit, tests)
  # don't look for. Advisory at first (not a required check); promote once tuned.
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # The runner image lacks pip, and a semgrep job-container lacks the node that
      # actions/checkout needs — so install pip via apt on the standard image.
      - name: Install semgrep
        run: |
          sudo apt-get update -qq && sudo apt-get install -y -qq python3-pip pipx
          pipx install semgrep
      - name: Semgrep scan
        run: |
          export PATH="$HOME/.local/bin:$PATH"
          semgrep scan --config p/csharp --config p/javascript --config p/security-audit             --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj'             --error --quiet