Repository navigation
feat(semgrep): add a reusable Semgrep CE scan workflow - #198
Merged
Merged
Conversation
added 2 commits
October 21, 2026 19:28
The private nightowlstudiollc repos get no CodeQL without GitHub Code Security, which was declined. semgrep-scan.yml runs Semgrep Community Edition in its place. - pull_request: semgrep scan --error with --baseline-commit at the PR base, so only findings new in the PR fail. push and workflow_dispatch scan the whole tree. - An optional SEMGREP_APP_TOKEN switches the run to semgrep ci; the platform's policies then replace the rulesets input. - The job has contents: read only. No SARIF upload, because code scanning on a private repo needs the SKU this replaces. - The mode logic is semgrep/run-semgrep.sh, checked out at job.workflow_sha like netlify/. Semgrep 1.182.0 is pinned in semgrep/requirements.txt, installed into a venv, and bumped by a new pip entry in dependabot.yml. - tests/test-semgrep-scan.sh covers each mode against a stub semgrep. run-tests.sh already globs test-*.sh, so it needs no change. Not a required check. Advances smartwatermelon/dev-env#166.
A full scan on push keeps main honest: findings that predate a PR still show up. Repos fix their existing findings before adding the caller, so the first push run is green. Advances smartwatermelon/dev-env#166.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
semgrep-scan.yml, a reusable workflow that runs Semgrep CE as a stand-in for CodeQL on private repos without GitHub Code Security.pull_requestit fails only on findings new in the PR (--baseline-commitat the PR base).pushandworkflow_dispatchscan the whole tree.SEMGREP_APP_TOKENswitches it tosemgrep ci, so the Semgrep platform can be adopted later without a caller change.semgrep/requirements.txt; Dependabot bumps it. No SARIF upload, since that needs Code Security on private repos.semgrep/caller-stub.yml, pinned to@semgrep-scan-v1(tag created after merge).Advances smartwatermelon/dev-env#166.
Test plan
bash tests/test-semgrep-scan.sh: 16 hermetic cases against a stubsemgrep(event routing, baseline SHA validation, ruleset validation, token path, and workflow/stub/README agreement).