From e000332b958331c5212408475db6180f27087885 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Thu, 2 Jul 2026 18:17:13 +0200 Subject: [PATCH] ci(security): install semgrep via apt+pipx on the runner image The semgrep job-container approach fails because actions/checkout needs node inside the container. Install pipx via apt on the standard image instead. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/security.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index d16b369..cf69641 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -58,9 +58,15 @@ jobs: # don't look for. Advisory at first (not a required check); promote once tuned. sast: runs-on: ubuntu-latest - container: semgrep/semgrep # official image — the runner's base image lacks pip steps: - uses: actions/checkout@v4 + # The runner image lacks pip, and a semgrep job-container lacks the node that + # actions/checkout needs — so install pip via apt on the standard image. + - name: Install semgrep + run: | + sudo apt-get update -qq && sudo apt-get install -y -qq python3-pip pipx + pipx install semgrep - name: Semgrep scan run: | + export PATH="$HOME/.local/bin:$PATH" semgrep scan --config p/csharp --config p/javascript --config p/security-audit --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj' --error --quiet