chore(ci): remove fips-compatibility.yml; repo has no FIPS components #112
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | ||
|
Check failure on line 1 in .github/workflows/security-semgrep.yml
|
||
| # Front-Matter for GitHub Workflow | ||
| title: "Security Semgrep Workflow" | ||
| name: "security-semgrep.yml" | ||
| description: "Run Semgrep security scans via Nox session using unified .semgrep.yml" | ||
| category: security | ||
| usage: "Trigger on push to src/**, tests/**, .semgrep.yml; on pull_request; and weekly on Sunday at 02:00 UTC" | ||
| behavior: "Executes Nox session \"semgrep\" (which installs Semgrep==1.119.0 and runs .semgrep.yml, producing a SARIF); fails on any findings" | ||
| inputs: "triggers: schedule, push, pull_request; secrets: none" # pragma: allowlist secret | ||
| outputs: "semgrep.sarif" | ||
| dependencies: "github/codeql-action/upload-sarif@v3" | ||
| author: "Byron Williams" | ||
| last_modified: "2025-04-19" | ||
| changelog: "Added pip cache; generate & upload SARIF via Nox session" | ||
| tags: [security, semgrep, ci] | ||
| --- | ||
| name: Security – Semgrep via Nox | ||
| on: | ||
| push: | ||
| paths: | ||
| - "src/**" | ||
| - "tests/**" | ||
| - "semgrep.yml" | ||
| pull_request: | ||
| schedule: | ||
| - cron: "0 2 * * 0" # Weekly on Sunday at 02:00 UTC | ||
| permissions: | ||
| contents: read | ||
| env: | ||
| SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} # pragma: allowlist secret | ||
| SEMGREP_DEPLOYMENT_ID: ${{ secrets.SEMGREP_DEPLOYMENT_ID }} # pragma: allowlist secret | ||
| jobs: | ||
| prepare: | ||
| name: Prepare Poetry & Assured OSS | ||
| uses: ./.github/workflows/templates/prepare-poetry.yml | ||
| with: | ||
| GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }} | ||
| secrets: | ||
| GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }} | ||
| semgrep: | ||
| name: Run Semgrep scans | ||
| needs: prepare | ||
| runs-on: ubuntu-22.04 | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| - name: Verify no public PyPI fallbacks | ||
| run: poetry run nox -s verify_assured | ||
| - name: Run Semgrep session | ||
| run: | | ||
| if [ "${{ github.event_name }}" = "pull_request" ]; then | ||
| poetry run nox -s semgrep_ci | ||
| else | ||
| poetry run nox -s semgrep_full | ||
| fi | ||
| - name: Upload Semgrep SARIF (PR only) | ||
| if: github.event_name == 'pull_request' | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: docs/reports/sarif/semgrep-ci.sarif | ||
