ci(security): install semgrep via apt+pipx on the runner image

The semgrep job-container approach fails because actions/checkout needs node inside the container. Install pipx via apt on the standard image instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ci(security): run Semgrep in its official container
2026-07-02 18:17:13 +02:00 · 2026-07-02 17:35:39 +02:00 · 2026-07-02 17:08:26 +02:00
1 changed files with 18 additions and 0 deletions
@@ -52,3 +52,21 @@ jobs:
        # (Vite/PostCSS/etc.) shouldn't block a merge.
        working-directory: frontend
        run: npm audit --omit=dev --audit-level=high
+
+  # RECOMMENDATIONS #9: SAST. Semgrep community rules for C#/JS + OWASP/secrets patterns —
+  # catches injection/crypto-misuse classes the other gates (gitleaks, dep-audit, tests)
+  # don't look for. Advisory at first (not a required check); promote once tuned.
+  sast:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # The runner image lacks pip, and a semgrep job-container lacks the node that
+      # actions/checkout needs — so install pip via apt on the standard image.
+      - name: Install semgrep
+        run: |
+          sudo apt-get update -qq && sudo apt-get install -y -qq python3-pip pipx
+          pipx install semgrep
+      - name: Semgrep scan
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          semgrep scan --config p/csharp --config p/javascript --config p/security-audit             --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj'             --error --quiet
Author	SHA1	Message	Date
cesnimda	e000332b95	ci(security): install semgrep via apt+pipx on the runner image CI / backend (pull_request) Successful in 1m2s Details CI / frontend (pull_request) Successful in 16s Details CI / format (pull_request) Successful in 55s Details CI / db-tests (pull_request) Successful in 1m3s Details Security / secrets (pull_request) Successful in 4s Details Security / dependencies (pull_request) Successful in 1m4s Details Security / sast (pull_request) Successful in 54s Details The semgrep job-container approach fails because actions/checkout needs node inside the container. Install pipx via apt on the standard image instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 18:17:13 +02:00
cesnimda	b79f35f40e	ci(security): run Semgrep in its official container CI / backend (pull_request) Successful in 57s Details CI / frontend (pull_request) Successful in 14s Details CI / format (pull_request) Successful in 56s Details CI / db-tests (pull_request) Successful in 1m1s Details Security / secrets (pull_request) Successful in 4s Details Security / dependencies (pull_request) Successful in 1m0s Details Security / sast (pull_request) Failing after 37s Details The runner's job image lacks pip, so the sast job failed in CI despite passing locally. Use the semgrep/semgrep container instead of installing via pip. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 17:35:39 +02:00
cesnimda	89c89183da	ci(security): Semgrep SAST job (RECOMMENDATIONS #9 ) CI / backend (pull_request) Successful in 51s Details CI / frontend (pull_request) Successful in 13s Details CI / format (pull_request) Successful in 49s Details CI / db-tests (pull_request) Successful in 55s Details Security / secrets (pull_request) Successful in 4s Details Security / dependencies (pull_request) Successful in 59s Details Security / sast (pull_request) Failing after 3s Details p/csharp + p/javascript + p/security-audit rulesets; advisory (not a required check) until tuned. Verified locally: current codebase scans clean (0 findings). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 17:08:26 +02:00