From 54bb8771bc9ef51c5edeaff3e848d825e430bfa4 Mon Sep 17 00:00:00 2001 From: Georges-Antoine Assi Date: Tue, 4 Aug 2026 10:18:34 -0400 Subject: [PATCH 1/6] fix(ci): stop semgrep-general timing out on every PR semgrep-general was the only semgrep job without a changed-paths gate, so it ran on 100% of PRs while scanning only the directories the other jobs exclude. Its p50 is 12.3 min against a 20 min timeout, so slow runners tripped it and blocked the required Semgrep Checks Pass check. Gate it on the complement of its own --exclude list and raise the timeout to 30, matching semgrep-python. Coverage is unchanged: master pushes and oversized PRs still bypass the filter. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci-security.yaml | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci-security.yaml b/.github/workflows/ci-security.yaml index 9cbe9fd1b036..b5c1e7ee8c8a 100644 --- a/.github/workflows/ci-security.yaml +++ b/.github/workflows/ci-security.yaml @@ -31,6 +31,7 @@ jobs: rust: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.rust || 'true' }} js: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.js || 'true' }} products-frontend: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.products-frontend || 'true' }} + general: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.general || 'true' }} devex: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.devex || 'true' }} test-rules: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.test-rules || 'true' }} desktop: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.desktop || 'true' }} @@ -85,6 +86,22 @@ jobs: - 'products/**' - '.semgrep/rules/security/prefer-codegen-api.yaml' - '.github/workflows/ci-security.yaml' + # semgrep-general scans whatever the language-specific jobs + # don't. Keep these excludes aligned with its --exclude list. + general: + - '**' + - '!cli/**' + - '!common/**' + - '!ee/**' + - '!frontend/**' + - '!livestream/**' + - '!nodejs/**' + - '!posthog/**' + - '!products/**' + - '!rust/**' + - '!.semgrep/**' + - '!docs/**' + - '!services/**' # Keep these paths aligned with semgrep-devex's scan targets. devex: - 'bin/**' @@ -308,8 +325,12 @@ jobs: # scans GitHub Actions and other repo-wide config semgrep-general: + needs: changes + if: needs.changes.outputs.general == 'true' runs-on: ubuntu-latest - timeout-minutes: 20 + # The scan itself sits around 12 minutes, so 20 left too little headroom + # for a slow runner and the job was tripping the timeout. + timeout-minutes: 30 env: DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }} From 89ad35f0fa01510ce35485cf9b120213ac37367f Mon Sep 17 00:00:00 2001 From: Georges-Antoine Assi Date: Tue, 4 Aug 2026 10:50:03 -0400 Subject: [PATCH 2/6] perf(ci): bump semgrep 1.167.0 -> 1.172.0 The 1.163.0 -> 1.167.0 bump in #65921 made semgrep-general 4x slower on linux/amd64: p50 went from 3.1 to 12 min within two minutes of that merge (455 runs before, 143 after). The regression does not reproduce on arm64, where 1.163, 1.167 and 1.172 all run the same scan in ~82s. Bump forward rather than revert, since #65921 moved off 1.163.0 to fix an intermittent hang. Whether this clears the amd64 regression can only be measured in CI. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci-security.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-security.yaml b/.github/workflows/ci-security.yaml index b5c1e7ee8c8a..06af7e461bf7 100644 --- a/.github/workflows/ci-security.yaml +++ b/.github/workflows/ci-security.yaml @@ -11,7 +11,7 @@ permissions: env: SEMGREP_ENABLE_VERSION_CHECK: 'false' - SEMGREP_IMAGE: semgrep/semgrep:1.167.0@sha256:06938c1f365d3f67b8cedd8bc117607ae64253f88a0e768e9da9408548927dd6 + SEMGREP_IMAGE: semgrep/semgrep:1.172.0@sha256:65dcd4408adda7c183a6b4550cb1e9b19f7f627a6fbb7e0559bd466bedc44d7b jobs: # Job to decide which path-scoped semgrep scans need to run. From 3165db86cb6c63a51e522c7806cde75726390531 Mon Sep 17 00:00:00 2001 From: Georges-Antoine Assi Date: Tue, 4 Aug 2026 11:19:02 -0400 Subject: [PATCH 3/6] revert(ci): keep semgrep pinned at 1.167.0 Bumping to 1.172.0 did not clear the amd64 regression: semgrep-general came in at 18.7 min against a 12.3 min p50 on 1.167.0, nowhere near the 3.1 min it ran at before #65921. No benefit to justify moving the pin. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci-security.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-security.yaml b/.github/workflows/ci-security.yaml index 06af7e461bf7..b5c1e7ee8c8a 100644 --- a/.github/workflows/ci-security.yaml +++ b/.github/workflows/ci-security.yaml @@ -11,7 +11,7 @@ permissions: env: SEMGREP_ENABLE_VERSION_CHECK: 'false' - SEMGREP_IMAGE: semgrep/semgrep:1.172.0@sha256:65dcd4408adda7c183a6b4550cb1e9b19f7f627a6fbb7e0559bd466bedc44d7b + SEMGREP_IMAGE: semgrep/semgrep:1.167.0@sha256:06938c1f365d3f67b8cedd8bc117607ae64253f88a0e768e9da9408548927dd6 jobs: # Job to decide which path-scoped semgrep scans need to run. From 18a54afbb61a220c2ed8eaa0c2846e44afb00cca Mon Sep 17 00:00:00 2001 From: Georges-Antoine Assi Date: Tue, 4 Aug 2026 11:21:55 -0400 Subject: [PATCH 4/6] chore(ci): add temporary semgrep rule-pack isolation jobs Splits semgrep-general's rule packs to test whether p/github-actions carries the 3.9x regression. semgrep-general is the 4-pack control. Not wired into semgrep_checks, so they gate nothing. To be removed. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci-security.yaml | 98 ++++++++++++++++++++++++++++++ 1 file changed, 98 insertions(+) diff --git a/.github/workflows/ci-security.yaml b/.github/workflows/ci-security.yaml index b5c1e7ee8c8a..9039a1789ce5 100644 --- a/.github/workflows/ci-security.yaml +++ b/.github/workflows/ci-security.yaml @@ -381,6 +381,104 @@ jobs: --exclude ./services/ \ . + # TEMPORARY DIAGNOSTIC — remove before merge. + # semgrep-general got 3.9x slower on the 1.163.0 -> 1.167.0 bump while every + # other semgrep job stayed flat. These two jobs split its rule packs to find + # out whether p/github-actions carries the whole cost. semgrep-general above + # is the 4-pack control, so the two halves should roughly sum to it. + # Deliberately not wired into semgrep_checks — these must not gate anything. + diag-without-github-actions: + needs: changes + if: needs.changes.outputs.general == 'true' + runs-on: ubuntu-latest + timeout-minutes: 30 + env: + DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} + steps: + - name: Log in to Docker Hub + if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }} + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + with: + username: ${{ vars.DOCKERHUB_USER }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Run Semgrep without p/github-actions + continue-on-error: true + run: | + docker run --rm -v "${{ github.workspace }}:/src" -w /src \ + -e SEMGREP_ENABLE_VERSION_CHECK=false \ + ${{ env.SEMGREP_IMAGE }} \ + semgrep \ + --config "p/owasp-top-ten" \ + --config "p/security-audit" \ + --config "p/trailofbits" \ + --exclude-rule dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile \ + --exclude-rule trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport \ + --exclude-rule trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces \ + --error \ + --metrics=off \ + --jobs 4 \ + --timeout 300 \ + --exclude ./cli/ \ + --exclude ./common/ \ + --exclude ./ee/ \ + --exclude ./frontend/ \ + --exclude ./livestream/ \ + --exclude ./nodejs/ \ + --exclude ./posthog/ \ + --exclude ./products/ \ + --exclude ./rust/ \ + --exclude ./.semgrep/ \ + --exclude ./docs/ \ + --exclude ./services/ \ + . + + diag-only-github-actions: + needs: changes + if: needs.changes.outputs.general == 'true' + runs-on: ubuntu-latest + timeout-minutes: 30 + env: + DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} + steps: + - name: Log in to Docker Hub + if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }} + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + with: + username: ${{ vars.DOCKERHUB_USER }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Run Semgrep with only p/github-actions + continue-on-error: true + run: | + docker run --rm -v "${{ github.workspace }}:/src" -w /src \ + -e SEMGREP_ENABLE_VERSION_CHECK=false \ + ${{ env.SEMGREP_IMAGE }} \ + semgrep \ + --config "p/github-actions" \ + --exclude-rule yaml.github-actions.security.audit.unsafe-add-mask-workflow-command.unsafe-add-mask-workflow-command \ + --error \ + --metrics=off \ + --jobs 4 \ + --timeout 300 \ + --exclude ./cli/ \ + --exclude ./common/ \ + --exclude ./ee/ \ + --exclude ./frontend/ \ + --exclude ./livestream/ \ + --exclude ./nodejs/ \ + --exclude ./posthog/ \ + --exclude ./products/ \ + --exclude ./rust/ \ + --exclude ./.semgrep/ \ + --exclude ./docs/ \ + --exclude ./services/ \ + . + # Devex / hygiene rules. Two passes: # - WARNING-severity rules print findings without failing the job # (used while migrating away from a pattern with a known backlog). From 823b5b29bed9d72b2dd8f833314d09052dab5709 Mon Sep 17 00:00:00 2001 From: Georges-Antoine Assi Date: Tue, 4 Aug 2026 11:51:26 -0400 Subject: [PATCH 5/6] chore(ci): narrow semgrep diagnostics to individual rule packs Round 1 cleared p/github-actions (0.7 min) and put the cost on the other three packs (12.2 min). These run each pack alone, plus one job that adds --severity=ERROR to test whether the generic multilang rules drive it. Still not wired into semgrep_checks. To be removed. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci-security.yaml | 110 +++++++++++++++++++++++++---- 1 file changed, 97 insertions(+), 13 deletions(-) diff --git a/.github/workflows/ci-security.yaml b/.github/workflows/ci-security.yaml index 9039a1789ce5..5c62007dd59c 100644 --- a/.github/workflows/ci-security.yaml +++ b/.github/workflows/ci-security.yaml @@ -382,12 +382,12 @@ jobs: . # TEMPORARY DIAGNOSTIC — remove before merge. - # semgrep-general got 3.9x slower on the 1.163.0 -> 1.167.0 bump while every - # other semgrep job stayed flat. These two jobs split its rule packs to find - # out whether p/github-actions carries the whole cost. semgrep-general above - # is the 4-pack control, so the two halves should roughly sum to it. + # Round 1 cleared p/github-actions (0.7 min) and pinned the cost on the other + # three packs (12.2 min). These narrow it to a single pack, and the last job + # tests whether the generic rules are the driver: --severity=ERROR + # cuts those from 24 rules to 3 and is why semgrep-desktop runs in 1 min. # Deliberately not wired into semgrep_checks — these must not gate anything. - diag-without-github-actions: + diag-owasp: needs: changes if: needs.changes.outputs.general == 'true' runs-on: ubuntu-latest @@ -404,7 +404,7 @@ jobs: password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Run Semgrep without p/github-actions + - name: Run Semgrep continue-on-error: true run: | docker run --rm -v "${{ github.workspace }}:/src" -w /src \ @@ -412,11 +412,93 @@ jobs: ${{ env.SEMGREP_IMAGE }} \ semgrep \ --config "p/owasp-top-ten" \ + --error \ + --metrics=off \ + --jobs 4 \ + --timeout 300 \ + --exclude ./cli/ \ + --exclude ./common/ \ + --exclude ./ee/ \ + --exclude ./frontend/ \ + --exclude ./livestream/ \ + --exclude ./nodejs/ \ + --exclude ./posthog/ \ + --exclude ./products/ \ + --exclude ./rust/ \ + --exclude ./.semgrep/ \ + --exclude ./docs/ \ + --exclude ./services/ \ + . + + diag-security-audit: + needs: changes + if: needs.changes.outputs.general == 'true' + runs-on: ubuntu-latest + timeout-minutes: 30 + env: + DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} + steps: + - name: Log in to Docker Hub + if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }} + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + with: + username: ${{ vars.DOCKERHUB_USER }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Run Semgrep + continue-on-error: true + run: | + docker run --rm -v "${{ github.workspace }}:/src" -w /src \ + -e SEMGREP_ENABLE_VERSION_CHECK=false \ + ${{ env.SEMGREP_IMAGE }} \ + semgrep \ --config "p/security-audit" \ + --error \ + --metrics=off \ + --jobs 4 \ + --timeout 300 \ + --exclude ./cli/ \ + --exclude ./common/ \ + --exclude ./ee/ \ + --exclude ./frontend/ \ + --exclude ./livestream/ \ + --exclude ./nodejs/ \ + --exclude ./posthog/ \ + --exclude ./products/ \ + --exclude ./rust/ \ + --exclude ./.semgrep/ \ + --exclude ./docs/ \ + --exclude ./services/ \ + . + + diag-trailofbits: + needs: changes + if: needs.changes.outputs.general == 'true' + runs-on: ubuntu-latest + timeout-minutes: 30 + env: + DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} + steps: + - name: Log in to Docker Hub + if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }} + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + with: + username: ${{ vars.DOCKERHUB_USER }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Run Semgrep + continue-on-error: true + run: | + docker run --rm -v "${{ github.workspace }}:/src" -w /src \ + -e SEMGREP_ENABLE_VERSION_CHECK=false \ + ${{ env.SEMGREP_IMAGE }} \ + semgrep \ --config "p/trailofbits" \ - --exclude-rule dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile \ - --exclude-rule trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport \ - --exclude-rule trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces \ + --exclude-rule trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport --exclude-rule trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces \ --error \ --metrics=off \ --jobs 4 \ @@ -435,7 +517,7 @@ jobs: --exclude ./services/ \ . - diag-only-github-actions: + diag-severity-error: needs: changes if: needs.changes.outputs.general == 'true' runs-on: ubuntu-latest @@ -452,15 +534,17 @@ jobs: password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Run Semgrep with only p/github-actions + - name: Run Semgrep continue-on-error: true run: | docker run --rm -v "${{ github.workspace }}:/src" -w /src \ -e SEMGREP_ENABLE_VERSION_CHECK=false \ ${{ env.SEMGREP_IMAGE }} \ semgrep \ - --config "p/github-actions" \ - --exclude-rule yaml.github-actions.security.audit.unsafe-add-mask-workflow-command.unsafe-add-mask-workflow-command \ + --config "p/owasp-top-ten" \ + --config "p/security-audit" \ + --config "p/trailofbits" \ + --severity=ERROR \ --error \ --metrics=off \ --jobs 4 \ From c74b9b6be0f2ed79c803f4169523fe5d310fc7e4 Mon Sep 17 00:00:00 2001 From: Georges-Antoine Assi Date: Tue, 4 Aug 2026 12:18:03 -0400 Subject: [PATCH 6/6] chore(ci): remove temporary semgrep diagnostic jobs Isolation is done: p/trailofbits accounts for 11.0 of semgrep-general's 12.5 min, and --severity=ERROR across all three packs runs in 1.4 min. Net diff is back to the path gate plus the timeout bump. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci-security.yaml | 182 ----------------------------- 1 file changed, 182 deletions(-) diff --git a/.github/workflows/ci-security.yaml b/.github/workflows/ci-security.yaml index 5c62007dd59c..b5c1e7ee8c8a 100644 --- a/.github/workflows/ci-security.yaml +++ b/.github/workflows/ci-security.yaml @@ -381,188 +381,6 @@ jobs: --exclude ./services/ \ . - # TEMPORARY DIAGNOSTIC — remove before merge. - # Round 1 cleared p/github-actions (0.7 min) and pinned the cost on the other - # three packs (12.2 min). These narrow it to a single pack, and the last job - # tests whether the generic rules are the driver: --severity=ERROR - # cuts those from 24 rules to 3 and is why semgrep-desktop runs in 1 min. - # Deliberately not wired into semgrep_checks — these must not gate anything. - diag-owasp: - needs: changes - if: needs.changes.outputs.general == 'true' - runs-on: ubuntu-latest - timeout-minutes: 30 - env: - DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }} - DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} - steps: - - name: Log in to Docker Hub - if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 - with: - username: ${{ vars.DOCKERHUB_USER }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Run Semgrep - continue-on-error: true - run: | - docker run --rm -v "${{ github.workspace }}:/src" -w /src \ - -e SEMGREP_ENABLE_VERSION_CHECK=false \ - ${{ env.SEMGREP_IMAGE }} \ - semgrep \ - --config "p/owasp-top-ten" \ - --error \ - --metrics=off \ - --jobs 4 \ - --timeout 300 \ - --exclude ./cli/ \ - --exclude ./common/ \ - --exclude ./ee/ \ - --exclude ./frontend/ \ - --exclude ./livestream/ \ - --exclude ./nodejs/ \ - --exclude ./posthog/ \ - --exclude ./products/ \ - --exclude ./rust/ \ - --exclude ./.semgrep/ \ - --exclude ./docs/ \ - --exclude ./services/ \ - . - - diag-security-audit: - needs: changes - if: needs.changes.outputs.general == 'true' - runs-on: ubuntu-latest - timeout-minutes: 30 - env: - DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }} - DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} - steps: - - name: Log in to Docker Hub - if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 - with: - username: ${{ vars.DOCKERHUB_USER }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Run Semgrep - continue-on-error: true - run: | - docker run --rm -v "${{ github.workspace }}:/src" -w /src \ - -e SEMGREP_ENABLE_VERSION_CHECK=false \ - ${{ env.SEMGREP_IMAGE }} \ - semgrep \ - --config "p/security-audit" \ - --error \ - --metrics=off \ - --jobs 4 \ - --timeout 300 \ - --exclude ./cli/ \ - --exclude ./common/ \ - --exclude ./ee/ \ - --exclude ./frontend/ \ - --exclude ./livestream/ \ - --exclude ./nodejs/ \ - --exclude ./posthog/ \ - --exclude ./products/ \ - --exclude ./rust/ \ - --exclude ./.semgrep/ \ - --exclude ./docs/ \ - --exclude ./services/ \ - . - - diag-trailofbits: - needs: changes - if: needs.changes.outputs.general == 'true' - runs-on: ubuntu-latest - timeout-minutes: 30 - env: - DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }} - DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} - steps: - - name: Log in to Docker Hub - if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 - with: - username: ${{ vars.DOCKERHUB_USER }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Run Semgrep - continue-on-error: true - run: | - docker run --rm -v "${{ github.workspace }}:/src" -w /src \ - -e SEMGREP_ENABLE_VERSION_CHECK=false \ - ${{ env.SEMGREP_IMAGE }} \ - semgrep \ - --config "p/trailofbits" \ - --exclude-rule trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport --exclude-rule trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces \ - --error \ - --metrics=off \ - --jobs 4 \ - --timeout 300 \ - --exclude ./cli/ \ - --exclude ./common/ \ - --exclude ./ee/ \ - --exclude ./frontend/ \ - --exclude ./livestream/ \ - --exclude ./nodejs/ \ - --exclude ./posthog/ \ - --exclude ./products/ \ - --exclude ./rust/ \ - --exclude ./.semgrep/ \ - --exclude ./docs/ \ - --exclude ./services/ \ - . - - diag-severity-error: - needs: changes - if: needs.changes.outputs.general == 'true' - runs-on: ubuntu-latest - timeout-minutes: 30 - env: - DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }} - DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} - steps: - - name: Log in to Docker Hub - if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 - with: - username: ${{ vars.DOCKERHUB_USER }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Run Semgrep - continue-on-error: true - run: | - docker run --rm -v "${{ github.workspace }}:/src" -w /src \ - -e SEMGREP_ENABLE_VERSION_CHECK=false \ - ${{ env.SEMGREP_IMAGE }} \ - semgrep \ - --config "p/owasp-top-ten" \ - --config "p/security-audit" \ - --config "p/trailofbits" \ - --severity=ERROR \ - --error \ - --metrics=off \ - --jobs 4 \ - --timeout 300 \ - --exclude ./cli/ \ - --exclude ./common/ \ - --exclude ./ee/ \ - --exclude ./frontend/ \ - --exclude ./livestream/ \ - --exclude ./nodejs/ \ - --exclude ./posthog/ \ - --exclude ./products/ \ - --exclude ./rust/ \ - --exclude ./.semgrep/ \ - --exclude ./docs/ \ - --exclude ./services/ \ - . - # Devex / hygiene rules. Two passes: # - WARNING-severity rules print findings without failing the job # (used while migrating away from a pattern with a known backlog).