2026-07-04 16:01:35 +02:00
1 changed files with 1 additions and 1 deletions
@@ -58,9 +58,9 @@ jobs:
  # don't look for. Advisory at first (not a required check); promote once tuned.
  sast:
    runs-on: ubuntu-latest
+    container: semgrep/semgrep   # official image — the runner's base image lacks pip
    steps:
      - uses: actions/checkout@v4
      - name: Semgrep scan
        run: |
-          pip install --quiet semgrep
          semgrep scan --config p/csharp --config p/javascript --config p/security-audit             --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj'             --error --quiet