From 4f09eed64b4b4cc89547a7103c336b3542af714b Mon Sep 17 00:00:00 2001 From: Frank Tucker Date: Mon, 12 Oct 2026 22:04:49 +0000 Subject: [PATCH] ci: add MicroHealth's shared Opengrep SAST workflow .github/workflows/sast.yml calls MicroHealthLLC/sast-rules' reusable opengrep.yml, pinned by commit (v2026.10.0), nightly at 02:30 UTC and on workflow_dispatch. Report-only (fail_on_findings off): SARIF to code scanning, the JSON report to S3 under SimplrSSH/sast/. SECURITY.md says so beside the Tests workflow's gates. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/sast.yml | 20 ++++++++++++++++++++ SECURITY.md | 5 +++++ 2 files changed, 25 insertions(+) create mode 100644 .github/workflows/sast.yml diff --git a/.github/workflows/sast.yml b/.github/workflows/sast.yml new file mode 100644 index 0000000..e852d4b --- /dev/null +++ b/.github/workflows/sast.yml @@ -0,0 +1,20 @@ +name: SAST +# MicroHealth's shared static analysis: Opengrep with MicroHealth's rules +# (MicroHealthLLC/sast-rules). The pin below is moved by a pull request that +# sast-rules opens on each release; merging it is how this repository takes +# new rules. +on: + schedule: + # Daily — 10:30 PM US Eastern (EDT) = 02:30 UTC the next day + - cron: "30 2 * * *" + workflow_dispatch: +permissions: + contents: read +jobs: + sast: + permissions: {contents: read, actions: read, security-events: write, id-token: write} + uses: MicroHealthLLC/sast-rules/.github/workflows/opengrep.yml@d7c3dad1ed1fe24d092f469360ca68d00a3a654d # v2026.10.0 + with: + aws_region: ${{ vars.AWS_REGION_EAST_1 }} + s3_bucket: ${{ vars.SECURITY_REPORTS_S3_BUCKET }} + secrets: inherit diff --git a/SECURITY.md b/SECURITY.md index c392582..4e3bb00 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -110,6 +110,11 @@ a release waits for it to pass on the same commit. Security-relevant gates: audit (esp-idf-sbom, NVD) of ESP-IDF, its libraries and the components of both images that blocks on new high/critical findings. +Outside the Tests workflow, `.github/workflows/sast.yml` runs MicroHealth's shared static +analysis nightly (and on demand): Opengrep with MicroHealth's rules +(`MicroHealthLLC/sast-rules`, pinned by commit). It is report-only; findings go to GitHub code +scanning and to MicroHealth's security reports. + Found while introducing these checks: | Finding | Status |