Semgrep Security Scan #155

	name: "Semgrep Security Scan"

	on:
	push:
	branches: ["main"]
	paths:
	- "src/**"
	- "build.rs"
	- "Cargo.toml"
	- "Cargo.lock"
	- ".github/workflows/semgrep.yml"
	pull_request:
	branches: ["main"]
	paths:
	- "src/**"
	- "build.rs"
	- "Cargo.toml"
	- "Cargo.lock"
	- ".github/workflows/semgrep.yml"
	schedule:
	- cron: "30 2 * * 1" # Runs weekly as a fallback

	permissions: read-all

	jobs:
	semgrep:
	name: Scan
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	contents: read
	steps:
	- name: Checkout repository
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	# Run via the official Docker image pinned by digest so the install path is
	# hash-verified end-to-end (no transient pip dependency resolution at CI time).
	# Known false positives (unsafe-usage in GTK bindings, SHA-1 mandated by
	# Immich protocol, current-exe in autostart entry) are dismissed in the
	# GitHub Security tab so the audit trail lives next to the alerts.
	- name: Run Semgrep
	run: \|
	docker run --rm -v "${PWD}:/src" --workdir /src \
	semgrep/semgrep@sha256:7cad2bc2d1e44f87f0bf4be6d1fa23aa90fb72015bebc89fb91385d813987a03 \
	semgrep scan \
	--config="p/rust" \
	--config="p/secrets" \
	--sarif --output=semgrep.sarif \|\| true
	# `\|\| true` keeps the SARIF upload step running even when findings exist;
	# GitHub Code Scanning surfaces severities, so CI gating happens there.

	- name: Upload SARIF to GitHub Code Scanning
	uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
	with:
	sarif_file: semgrep.sarif
	category: semgrep

Navigation Menu