cesnimda/Inboxintel

ci(security): Semgrep SAST #32

Merged

cesnimda merged 3 commits from feat/semgrep into develop

2026-07-04 16:01:35 +02:00

Author	SHA1	Message	Date
cesnimda	e000332b95	ci(security): install semgrep via apt+pipx on the runner image CI / backend (pull_request) Successful in 1m2s Details CI / frontend (pull_request) Successful in 16s Details CI / format (pull_request) Successful in 55s Details CI / db-tests (pull_request) Successful in 1m3s Details Security / secrets (pull_request) Successful in 4s Details Security / dependencies (pull_request) Successful in 1m4s Details Security / sast (pull_request) Successful in 54s Details The semgrep job-container approach fails because actions/checkout needs node inside the container. Install pipx via apt on the standard image instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 18:17:13 +02:00
cesnimda	b79f35f40e	ci(security): run Semgrep in its official container CI / backend (pull_request) Successful in 57s Details CI / frontend (pull_request) Successful in 14s Details CI / format (pull_request) Successful in 56s Details CI / db-tests (pull_request) Successful in 1m1s Details Security / secrets (pull_request) Successful in 4s Details Security / dependencies (pull_request) Successful in 1m0s Details Security / sast (pull_request) Failing after 37s Details The runner's job image lacks pip, so the sast job failed in CI despite passing locally. Use the semgrep/semgrep container instead of installing via pip. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 17:35:39 +02:00
cesnimda	89c89183da	ci(security): Semgrep SAST job (RECOMMENDATIONS #9 ) CI / backend (pull_request) Successful in 51s Details CI / frontend (pull_request) Successful in 13s Details CI / format (pull_request) Successful in 49s Details CI / db-tests (pull_request) Successful in 55s Details Security / secrets (pull_request) Successful in 4s Details Security / dependencies (pull_request) Successful in 59s Details Security / sast (pull_request) Failing after 3s Details p/csharp + p/javascript + p/security-audit rulesets; advisory (not a required check) until tuned. Verified locally: current codebase scans clean (0 findings). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 17:08:26 +02:00