ci(security): Semgrep SAST #32

Merged

cesnimda merged 3 commits from feat/semgrep into develop 2026-07-04 16:01:35 +02:00

Conversation 0 Commits 3 Files Changed 1

+18

cesnimda commented 2026-07-02 17:08:29 +02:00

Owner

Copy Link

Copy Source

Recommendation #9. Advisory SAST job; local scan of the repo is clean.

🤖 Generated with Claude Code

Recommendation #9. Advisory SAST job; local scan of the repo is clean. 🤖 Generated with Claude Code

cesnimda added 1 commit 2026-07-02 17:08:29 +02:00

ci(security): Semgrep SAST job (RECOMMENDATIONS #9) ... 89c89183da

p/csharp + p/javascript + p/security-audit rulesets; advisory (not a required
check) until tuned. Verified locally: current codebase scans clean (0 findings).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cesnimda added 1 commit 2026-07-02 17:35:43 +02:00

ci(security): run Semgrep in its official container ... b79f35f40e

The runner's job image lacks pip, so the sast job failed in CI despite passing
locally. Use the semgrep/semgrep container instead of installing via pip.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cesnimda added 1 commit 2026-07-02 18:17:16 +02:00

ci(security): install semgrep via apt+pipx on the runner image ... e000332b95

The semgrep job-container approach fails because actions/checkout needs node
inside the container. Install pipx via apt on the standard image instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cesnimda merged commit 1e8feeef71 into develop 2026-07-04 16:01:35 +02:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

cesnimda

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cesnimda/Inboxintel#32