ci: align security jobs with the house standard - #3
Merged
Conversation
Adds the two security jobs coco-dashboard runs that this repo lacked: - Semgrep (semgrep/semgrep container, --config auto --error --severity ERROR) - dependency audit via npm audit --audit-level=high CodeQL is kept rather than replaced. It is free on public repositories, and it caught a high-severity ReDoS in this repo's own guard script that Semgrep's 200 auto rules did not flag when run against the same pattern, so the two are complementary and dropping either would lose coverage. OSV-Scanner is not included: it scans a lockfile, and this package declares no dependencies and ships no lockfile, so the job would report on nothing.
boot-coco
approved these changes
Aug 4, 2026
boot-coco
left a comment
boot-coco
left a comment
Contributor
There was a problem hiding this comment.
Code Review — Boot (审 sha 557eeb9)
Verdict: APPROVE
Same content as closed PR #2, re-reviewed against main:
- Semgrep:
semgrep/semgrepcontainer,--config auto --error --severity ERROR. Complementary to CodeQL (CodeQL caught ReDoS that Semgrep's 200 rules missed → keep both). - Dependency audit:
npm install --package-lock-only+npm audit --audit-level=high. Zero deps today (documented in comment), becomes blocking gate when deps added. Correct choice over OSV-Scanner (no lockfile = vacuous). - No job ordering issues, both independent.
Merging per DEC-074.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns this repo's security CI with
coco-dashboard, per Owen's instruction to follow that pattern and use no paid services.Replaces PR #2, which GitHub auto-closed when its base branch (
fix/identifier-allowlist) was deleted on merge — a stacked PR does not retarget itself. Same change, based onmain.Added — the two jobs coco-dashboard has that this repo lacked:
semgrep/semgrepcontainer,--config auto --error --severity ERROR, same invocation ascoco-dashboard/.github/workflows/sast.yml.npm audit --audit-level=high. This package declares no dependencies and ships no lockfile, so it passes trivially today. Wired up regardless so the audit becomes real and blocking the moment a dependency appears, rather than something someone must remember to add later.Not added — OSV-Scanner. It scans a lockfile; with zero dependencies and no lockfile there is nothing for it to report on. A job that always says "nothing found" because it is looking at nothing is worse than no job — it reads as coverage. Worth adding the moment this package gains dependencies.
CodeQL kept, not replaced — measured, not assumed. It is free on public repositories, and it caught a real high-severity ReDoS in this repo's own guard script. Running Semgrep
--config auto(200 rules) against that exact pattern in isolation gave 0 findings, so swapping CodeQL out for consistency would have traded a control that has already proven itself for one that misses this class.