github-featured / ruvnet--ruview

发布

0 发布 302 Git 标签

RSS 订阅源
  • v1588 d9e87e13b4
    比较

    fix(ci): SAST actually scans the code + drop deprecated flaky semgrep action (#930)

    frostbyte_neo 发布于 2026-06-03 09:18:49 +00:00

    Two real problems in the Static Application Security Testing job:

    1. It scanned a path that no longer exists. bandit -r src/ and
      semgrep … src/ pointed at the repo-root src/, but the Python code
      moved to archive/v1/src/ (64 .py files) when the runtime was rewritten
      in Rust. So the SAST scan matched nothing — a silent no-op (this is also
      why bandit-results.sarif was "Path does not exist" on recent runs).
      Fixed both to archive/v1/src/.

    2. Deprecated + redundant + flaky semgrep step. The
      returntocorp/semgrep-action@v1 step pulled returntocorp/semgrep-agent:v1
      from Docker Hub every run (intermittently timing out → red check, e.g. on
      #929) and is EOL. It was redundant: the pip semgrep --sarif step is what
      feeds GitHub Security; the action only pushed to the Semgrep cloud app via
      SEMGREP_APP_TOKEN. Removed it and folded its p/docker + p/kubernetes
      rulesets into the pip semgrep command, so coverage is preserved with no
      Docker pull.

    The job stays continue-on-error: true (non-gating). YAML validated.

    下载附件