What
magicsunday/.github#58 (merged) added a completeness gate to the shared code-scanning reusable workflow: it now fails the job when Semgrep silently skips a file for a reason not on an explicit allow list, instead of uploading a report that understates what was scanned.
This repository's docs/ directory holds vendored specification documents that legitimately exceed Semgrep's 1 MB size limit, so the gate now fails on every run.
Affected files (exceeded_size_limit, verified against the merged gate)
docs/DNG_Spec_1_7_1_0.htmldocs/DNG_Spec_1_7_1_0.pdfdocs/EXIF-230.pdfdocs/EXIF-231.pdfdocs/EXIF-300.htmldocs/EXIF-300.pdfdocs/EXIF-310.htmldocs/EXIF-310.pdfdocs/FPX.htmldocs/FPX.pdfdocs/ICC.htmldocs/ISO-12234-2.htmldocs/ISO_IEC_14496-12_2015.htmldocs/ISO_IEC_14496-12_2015.pdfdocs/MPF.htmldocs/MPF.pdfdocs/Quicktime-File-Format-2001.htmldocs/Quicktime-File-Format-2001.pdfdocs/Quicktime-File-Format-2012.htmldocs/Quicktime-File-Format-2012.pdfdocs/TIFF6.htmldocs/XMP.html
Fix
The reusable workflow added an excludes workflow_call input for exactly this case (a caller-declared list of legitimately-unscannable files, kept separate from .semgrepignore because that file replaces Semgrep's own default ignore list rather than adding to it).
Add a with: excludes: block to the code-scanning job in .github/workflows/security.yml, listing the paths above (space-separated).
Impact until fixed
code-scanning / Semgrep is not a required status check in this repository, so this does not block merges, only shows red on every run.
What
magicsunday/.github#58 (merged) added a completeness gate to the shared code-scanning reusable workflow: it now fails the job when Semgrep silently skips a file for a reason not on an explicit allow list, instead of uploading a report that understates what was scanned.
This repository's
docs/directory holds vendored specification documents that legitimately exceed Semgrep's 1 MB size limit, so the gate now fails on every run.Affected files (exceeded_size_limit, verified against the merged gate)
docs/DNG_Spec_1_7_1_0.htmldocs/DNG_Spec_1_7_1_0.pdfdocs/EXIF-230.pdfdocs/EXIF-231.pdfdocs/EXIF-300.htmldocs/EXIF-300.pdfdocs/EXIF-310.htmldocs/EXIF-310.pdfdocs/FPX.htmldocs/FPX.pdfdocs/ICC.htmldocs/ISO-12234-2.htmldocs/ISO_IEC_14496-12_2015.htmldocs/ISO_IEC_14496-12_2015.pdfdocs/MPF.htmldocs/MPF.pdfdocs/Quicktime-File-Format-2001.htmldocs/Quicktime-File-Format-2001.pdfdocs/Quicktime-File-Format-2012.htmldocs/Quicktime-File-Format-2012.pdfdocs/TIFF6.htmldocs/XMP.htmlFix
The reusable workflow added an
excludesworkflow_call input for exactly this case (a caller-declared list of legitimately-unscannable files, kept separate from.semgrepignorebecause that file replaces Semgrep's own default ignore list rather than adding to it).Add a
with: excludes:block to thecode-scanningjob in.github/workflows/security.yml, listing the paths above (space-separated).Impact until fixed
code-scanning / Semgrepis not a required status check in this repository, so this does not block merges, only shows red on every run.