ci: align security jobs with the house standard - #2
Closed
owen0x6f wants to merge 1 commit into
Closed
Conversation
Adds the two security jobs coco-dashboard runs that this repo lacked: - Semgrep (semgrep/semgrep container, --config auto --error --severity ERROR) - dependency audit via npm audit --audit-level=high CodeQL is kept rather than replaced. It is free on public repositories, and it caught a high-severity ReDoS in this repo's own guard script that Semgrep's 200 auto rules did not flag when run against the same pattern -- so the two are complementary and dropping either would lose coverage. OSV-Scanner is not included: it scans a lockfile, and this package declares no dependencies and ships no lockfile, so the job would report on nothing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns this repo's security CI with
coco-dashboard, per Owen's instruction to follow that pattern and use no paid services.Stacked on PR #1 (base is
fix/identifier-allowlist, notmain) so it does not conflict with the allowlist/secret-scan fixes still under review there.Added — the two jobs coco-dashboard has that this repo lacked:
semgrep/semgrepcontainer,--config auto --error --severity ERROR, same invocation ascoco-dashboard/.github/workflows/sast.yml.npm audit --audit-level=high. This package declares no dependencies and ships no lockfile, so it passes trivially today. Wired up regardless so the audit becomes real and blocking the moment a dependency appears, rather than being something someone must remember to add later.Not added — OSV-Scanner. It scans a lockfile; with zero dependencies and no lockfile there is nothing for it to report on. A job that always reports "nothing found" because it is looking at nothing is worse than no job: it reads as coverage. Worth revisiting the moment this package gains dependencies.
CodeQL kept, not replaced — measured, not assumed. It is free on public repositories, and it caught a real high-severity ReDoS in this repo's own guard script. I ran Semgrep
--config auto(200 rules) against that exact pattern in isolation: 0 findings. So Semgrep would not have caught it, and swapping CodeQL out for consistency would have traded a control that has already proven itself for one that missed this class.Correction to something I reported earlier. I said
gitleaks detect"only scans history, not the working tree," implying thecoco-dashboardinvocation has a blind spot. That over-reached: in CI withfetch-depth: 0the checkout's tree is committed content, so history mode covers everything in the PR. The tree-vs-history distinction matters for local or pre-commit use, not for a CI checkout. The two-step scan in PR #1 is still slightly more robust (it also covers generated or untracked files) but the house pattern was not broken.