Skip to content

ci(semgrep): consume the fleet-shared reusable Semgrep workflow #1760

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
krisarmstrong wants to merge 2 commits into
base: main
Choose a base branch
from
Open

ci(semgrep): consume the fleet-shared reusable Semgrep workflow #1760

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ec9f9fb
ci(semgrep): consume the fleet-shared reusable Semgrep workflow
Jul 10, 2026
adfa9ed
ci: pin fleet-shared reusable workflows to a tagged SHA
Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 3 additions & 24 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -469,33 +469,12 @@ jobs:
# above: SAST coverage on every PR is non-negotiable, and Semgrep is fast
# enough (~1-2 min for this ruleset) that gating it behind path filters
# isn't worth the added complexity.
# Defined once in MustardSeedNetworks/.github (fleet-shared); ci-complete
# still needs: [semgrep]. Edit the pinned version / config policy there.
semgrep:
name: Semgrep SAST
runs-on: ubuntu-latest
timeout-minutes: 10
uses: MustardSeedNetworks/.github/.github/workflows/semgrep.yml@762b756e6fb5803443b9bcfdba03b88596c18e04 # v1.0.0
permissions:
contents: read
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

- name: Set up Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: "3.13"

- name: Install Semgrep (pinned)
run: pip install "semgrep==1.168.0"

- name: Run Semgrep (blocking on ERROR severity)
run: |
semgrep scan \
--config p/golang \
--config p/typescript \
--config p/react \
--config p/owasp-top-ten \
--severity ERROR \
--error \
--metrics=off

# ===========================================================================
# Code Quality Checks
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/license-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,4 @@ jobs:
# To change license policy for the fleet, edit that workflow, not this file.
# foundation + modernc.org/mathutil are already ignored there fleet-wide.
license-check:
uses: MustardSeedNetworks/.github/.github/workflows/license-check.yml@main
uses: MustardSeedNetworks/.github/.github/workflows/license-check.yml@762b756e6fb5803443b9bcfdba03b88596c18e04 # v1.0.0
Loading