From b34cc2ba3b106fec0f4317799168ea74f934e8c4 Mon Sep 17 00:00:00 2001 From: Edwin van den Houdt Date: Wed, 22 Jul 2026 09:46:48 +0200 Subject: [PATCH] ci(semgrep): run in the official Semgrep container (setup-python failed on the runner) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The setup-python + `pip install semgrep` step errored on the Gitea runner. Switch to `container: docker.io/semgrep/semgrep` (semgrep preinstalled) — the documented way to run Semgrep in CI, and the exact execution verified locally (306 rules / 450 files, 27 findings, exit 0). Fully-qualified image name so short-name resolution works under Docker or podman. Still report-only (no --error); WP-30 tracks flipping to blocking. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ci.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 496bf95..c368e84 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -112,17 +112,17 @@ jobs: # SAST for both sides — replaces CodeQL, which is GitHub-only (its analyze step uploads # SARIF to GitHub's code-scanning API) and can't run on this Gitea instance. Semgrep OSS # is a plain CLI: no account, no external platform API. Findings print in the job log. + # Runs in the official Semgrep image (semgrep preinstalled) — the setup-python + pip + # approach failed on this runner. Fully-qualified image name so short-name resolution + # works regardless of the container engine (Docker or podman). # ponytail: report-only for now (no `--error`, so the job stays green while the initial # findings are triaged); flip to `--error` to make it a blocking gate. See WP-30. runs-on: ubuntu-latest timeout-minutes: 15 + container: + image: docker.io/semgrep/semgrep steps: - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 - with: - python-version: '3.12' - cache: pip - - run: pip install semgrep # p/default = curated cross-language security (covers JS/TS); p/csharp = the backend. # Anonymous registry fetch; --metrics=off disables telemetry (not `auto`, which uploads # project metadata).