perf(ci): gate local semgrep jobs on changed paths - #74230
Merged
Conversation
semgrep-general, semgrep-devex and semgrep-test-rules run on every PR. Measured against the file lists of all 136 PRs merged in a trailing 24-hour window, they have nothing in scope on 89%, 13% and 99% of them respectively, which is roughly 1,600 job-minutes a day. Each new filter mirrors what its job actually reads: - general: '**' minus the same twelve trees the job passes as --exclude flags. Deliberately expressed as excludes rather than positive includes so a new top-level directory fails open and still triggers the scan. - devex: the directory list the job hands to semgrep. - test-rules: '.semgrep/**' only, since `semgrep --test .semgrep/` exercises the rules against their own committed fixtures and cannot be affected by anything outside that tree. Coverage this deliberately preserves: - master pushes are untouched. The filter step is gated on `github.event_name != 'push'`, so every scan still runs unconditionally on master, which is what covers repo-wide drift and newly published rules against unchanged code. - .github/** always triggers general. That is the surface CODEOWNERS singles out as untrusted, and the job loads p/github-actions to scan it. - editing this workflow triggers every scan, the mitigation from #68640. - outputs keep their `|| 'true'` default, so a skipped or failed filter step fails open. Raising this as a proposal rather than folding it into a CI cost pass: #68640 left these three unconditional on purpose, and #70907 hit the same cost problem and chose `--jobs 4` over path filtering, explicitly to avoid weakening the check. Narrowing them is team-security's call. Generated-By: PostHog Code Task-Id: 7bad9f9c-04b8-40b0-b44c-e967a3f8c731
2 tasks
The comments added earlier in this PR were verbose, and the truncation NOTE contradicted the pre-existing lines it was appended to: those said the `|| 'true'` default makes scans run unconditionally, then the new text immediately qualified that it only covers a missing output. Merged into one statement, 9 lines to 6, with every fact intact. The `general` comment now also records why the filter is shaped as '**' plus negations rather than positive includes: a new top-level directory then fails open and still triggers the scan. That rationale was in the PR description but had never made it into the file, which is the one place a future editor would look before restructuring the filter. The one-for-one warning about semgrep-general's --exclude flags is preserved, including which direction of drift is the dangerous one. Comments only. Verified by parsing the workflow, re-parsing the `filters:` literal block (its comments are part of the string the action receives), and deep-comparing against the previous commit: byte-identical. Separately re-asserted that the `general` negations are still one-for-one with the job's --exclude flags. Generated-By: PostHog Code Task-Id: 7bad9f9c-04b8-40b0-b44c-e967a3f8c731
rnegron
changed the title
rnegron
marked this pull request as ready for review
July 28, 2026 15:11
Contributor
|
Reviews (1): Last reviewed commit: "fix(ci): harden semgrep path filters" | Re-trigger Greptile |
4 tasks
feliperalmeida
approved these changes
Jul 28, 2026
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Semgrep devex and rule-test jobs run on PRs that cannot affect their results.
Changes
semgrep-devexon its scan targets and local rules.semgrep-test-ruleson.semgrep/**.semgrep-generalunconditional because it loads live security packs.How did you test this code?
bin/hogli lint:workflowsactionlint -config-file .github/actionlint.yaml .github/workflows/ci-security.yamlgit diff --checkAutomatic notifications
Docs update
No user-facing behavior changes.
🤖 Agent context
Autonomy: Human-driven (agent-assisted)
Claude measured the original proposal. Codex narrowed it to locally defined checks and added the oversized-PR safeguard. Skills:
/code-review,/authoring-ci-workflows,/writing-code-comments,/writing-user-facing-copy, and/wt.