From 89c89183da38abb7b90f4b4e399466cb9dc0179c Mon Sep 17 00:00:00 2001 From: cesnimda Date: Thu, 2 Jul 2026 17:08:26 +0200 Subject: [PATCH 1/3] ci(security): Semgrep SAST job (RECOMMENDATIONS #9) p/csharp + p/javascript + p/security-audit rulesets; advisory (not a required check) until tuned. Verified locally: current codebase scans clean (0 findings). Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/security.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index c9a354e..f43843b 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -52,3 +52,15 @@ jobs: # (Vite/PostCSS/etc.) shouldn't block a merge. working-directory: frontend run: npm audit --omit=dev --audit-level=high + + # RECOMMENDATIONS #9: SAST. Semgrep community rules for C#/JS + OWASP/secrets patterns — + # catches injection/crypto-misuse classes the other gates (gitleaks, dep-audit, tests) + # don't look for. Advisory at first (not a required check); promote once tuned. + sast: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Semgrep scan + run: | + pip install --quiet semgrep + semgrep scan --config p/csharp --config p/javascript --config p/security-audit --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj' --error --quiet -- 2.52.0 From b79f35f40e43efaa3768103c68d3b45b996295b1 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Thu, 2 Jul 2026 17:35:39 +0200 Subject: [PATCH 2/3] ci(security): run Semgrep in its official container The runner's job image lacks pip, so the sast job failed in CI despite passing locally. Use the semgrep/semgrep container instead of installing via pip. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index f43843b..d16b369 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -58,9 +58,9 @@ jobs: # don't look for. Advisory at first (not a required check); promote once tuned. sast: runs-on: ubuntu-latest + container: semgrep/semgrep # official image — the runner's base image lacks pip steps: - uses: actions/checkout@v4 - name: Semgrep scan run: | - pip install --quiet semgrep semgrep scan --config p/csharp --config p/javascript --config p/security-audit --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj' --error --quiet -- 2.52.0 From e000332b958331c5212408475db6180f27087885 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Thu, 2 Jul 2026 18:17:13 +0200 Subject: [PATCH 3/3] ci(security): install semgrep via apt+pipx on the runner image The semgrep job-container approach fails because actions/checkout needs node inside the container. Install pipx via apt on the standard image instead. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/security.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index d16b369..cf69641 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -58,9 +58,15 @@ jobs: # don't look for. Advisory at first (not a required check); promote once tuned. sast: runs-on: ubuntu-latest - container: semgrep/semgrep # official image — the runner's base image lacks pip steps: - uses: actions/checkout@v4 + # The runner image lacks pip, and a semgrep job-container lacks the node that + # actions/checkout needs — so install pip via apt on the standard image. + - name: Install semgrep + run: | + sudo apt-get update -qq && sudo apt-get install -y -qq python3-pip pipx + pipx install semgrep - name: Semgrep scan run: | + export PATH="$HOME/.local/bin:$PATH" semgrep scan --config p/csharp --config p/javascript --config p/security-audit --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj' --error --quiet -- 2.52.0