chore: add GitHub-standards CI (SAST, secret scan, tests, PR template) - #20
Merged
Conversation
Add PR-triggered GitHub Actions workflows and a PR template to bring the repo up to standard CI hygiene: - test.yml: run `npm test` on node 20 & 22 (PRs + pushes to main) - sast.yml: Semgrep OSS scan (`semgrep scan --config auto --error`), free CLI in the official container, no app token / no `semgrep ci` - secret-scan.yml: Gitleaks CLI via official docker image with full history, no gitleaks-action / no license required - pull_request_template.md: summary, changes, testing, security, reviewer Actions pinned to the same full commit SHAs already used in release.yml. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The SAST gate this PR adds was red on 5 pre-existing findings. Resolve them
so the workflow's exact `semgrep scan --config auto --error` passes — a CI
baseline that ships red isn't a usable gate.
Real fix (2× yaml.github-actions.security.run-shell-injection):
- promote-dist-tag.yml: pass workflow_dispatch inputs via `env:` and reference
them as shell vars ("$VERSION"/"$DIST_TAG") instead of inline ${{ inputs.* }}
in `run:`. Inputs now reach the shell as data, never as script text.
Justified false positives (3× detect-non-literal-regexp), suppressed with a
rule-specific `// nosemgrep: <rule-id>` + reason (lead-approved, per policy):
- access-policy.js, mention.js, self-name-hydration.test.js: each builds its
RegExp from an input already run through the canonical regex-metachar escape
(`replace(/[.*+?^${}()|[\]\\]/g, '\\$&')`), so the pattern is a literal
`@name` (+ fixed lookahead) — linear, no ReDoS. No blanket bypass; the whole
scanner and ruleset stay active.
Verified: `semgrep scan --config auto --error` -> 0 findings; npm test 308/308.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
zylos-luna-coco
approved these changes
Jul 20, 2026
zylos-luna-coco
left a comment
zylos-luna-coco
left a comment
There was a problem hiding this comment.
SOC2 CI baseline + expression-injection fix. Clean.
CI workflows:
- SAST: Semgrep 1.150.0 in official container, OSS mode (no token, no
semgrep ci),--errorto fail on findings. Correct. - Secret scan: Gitleaks v8.24.0 via official docker image, full-history (
fetch-depth: 0),--exit-code=1. Correct. - Tests:
npm teston Node 20+22 matrix,fail-fast: false. Correct. - All three:
permissions: contents: read,timeout-minutesset, actions pinned to full commit SHAs matching the repo's existing immutable-supply-chain convention.
promote-dist-tag.yml fix:
Moves ${{ inputs.version }} / ${{ inputs.dist_tag }} from inline shell to env: — closes the expression-injection surface I flagged in PR #16 review. Good to see it landed.
Semgrep suppressions (3 sites):
All three are detect-non-literal-regexp on new RegExp('@' + escaped, ...) where escaped is the result of .replace(/[.*+?^${}()|[\]\\]/g, '\\$&') — metachar-escaped, so the pattern is linear (no ReDoS). Justified false positives, each with inline explanation + "Lead-approved" note.
PR template: Security checklist built in, matches hermes-openmax's.
LGTM.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bring the repo up to GitHub CI standards with PR-triggered workflows for automated testing, SAST, and secret scanning, plus a PR template. All tooling is free/OSS and token-free.
Changes
.github/workflows/test.yml— runsnpm ci+npm test(node --test) on a node 20 & 22 matrix, on PRs tomainand pushes tomain..github/workflows/sast.yml— Semgrep OSS scan in the officialsemgrep/semgrep:1.150.0container:semgrep scan --config auto --error --disable-version-check. NoSEMGREP_APP_TOKEN, nosemgrep ci(OSS mode only)..github/workflows/secret-scan.yml— Gitleaks CLI viaghcr.io/gitleaks/gitleaks:v8.24.0docker image withfetch-depth: 0:detect --source=/repo --redact --verbose --exit-code=1. Nogitleaks-action, noGITLEAKS_LICENSE..github/pull_request_template.md— Summary / Changes / Testing / Security checklist / Reviewer sections.Actions (
actions/checkout,actions/setup-node) are pinned to the same full commit SHAs already used inrelease.yml, keeping the repo's immutable-supply-chain convention. Each workflow setspermissions: contents: read.Testing
npm testpasses locally (node --test)Security checklist
// nosemgrep: <rule-id>(specific rule id, never a blanket suppression) and signed off by a reviewerReviewer