Skip to content

fix(ci): stop semgrep-general timing out on every PR #77481

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
gantoine wants to merge 7 commits into from
Closed

fix(ci): stop semgrep-general timing out on every PR #77481

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
54bb877
fix(ci): stop semgrep-general timing out on every PR
gantoine Aug 4, 2026
89ad35f
perf(ci): bump semgrep 1.167.0 -> 1.172.0
gantoine Aug 4, 2026
3165db8
revert(ci): keep semgrep pinned at 1.167.0
gantoine Aug 4, 2026
18a54af
chore(ci): add temporary semgrep rule-pack isolation jobs
gantoine Aug 4, 2026
823b5b2
chore(ci): narrow semgrep diagnostics to individual rule packs
gantoine Aug 4, 2026
c74b9b6
chore(ci): remove temporary semgrep diagnostic jobs
gantoine Aug 4, 2026
ab5eaf7
Merge branch 'master' into worktree-keen-seeking-snowglobe
gantoine Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 22 additions & 1 deletion .github/workflows/ci-security.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ jobs:
rust: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.rust || 'true' }}
js: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.js || 'true' }}
products-frontend: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.products-frontend || 'true' }}
general: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.general || 'true' }}
devex: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.devex || 'true' }}
test-rules: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.test-rules || 'true' }}
desktop: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.desktop || 'true' }}
Expand Down Expand Up @@ -85,6 +86,22 @@ jobs:
- 'products/**'
- '.semgrep/rules/security/prefer-codegen-api.yaml'
- '.github/workflows/ci-security.yaml'
# semgrep-general scans whatever the language-specific jobs
# don't. Keep these excludes aligned with its --exclude list.
general:
- '**'
- '!cli/**'
- '!common/**'
- '!ee/**'
- '!frontend/**'
- '!livestream/**'
- '!nodejs/**'
- '!posthog/**'
- '!products/**'
- '!rust/**'
- '!.semgrep/**'
- '!docs/**'
- '!services/**'
# Keep these paths aligned with semgrep-devex's scan targets.
devex:
- 'bin/**'
Expand Down Expand Up @@ -308,8 +325,12 @@ jobs:
# scans GitHub Actions and other repo-wide config
semgrep-general:
needs: changes
if: needs.changes.outputs.general == 'true'
runs-on: ubuntu-latest
timeout-minutes: 20
# The scan itself sits around 12 minutes, so 20 left too little headroom
# for a slow runner and the job was tripping the timeout.
timeout-minutes: 30

env:
DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }}
Expand Down
Loading