From 89c89183da38abb7b90f4b4e399466cb9dc0179c Mon Sep 17 00:00:00 2001 From: cesnimda Date: Thu, 2 Jul 2026 17:08:26 +0200 Subject: [PATCH] ci(security): Semgrep SAST job (RECOMMENDATIONS #9) p/csharp + p/javascript + p/security-audit rulesets; advisory (not a required check) until tuned. Verified locally: current codebase scans clean (0 findings). Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/security.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index c9a354e..f43843b 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -52,3 +52,15 @@ jobs: # (Vite/PostCSS/etc.) shouldn't block a merge. working-directory: frontend run: npm audit --omit=dev --audit-level=high + + # RECOMMENDATIONS #9: SAST. Semgrep community rules for C#/JS + OWASP/secrets patterns — + # catches injection/crypto-misuse classes the other gates (gitleaks, dep-audit, tests) + # don't look for. Advisory at first (not a required check); promote once tuned. + sast: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Semgrep scan + run: | + pip install --quiet semgrep + semgrep scan --config p/csharp --config p/javascript --config p/security-audit --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj' --error --quiet