ci: add basedpyright config scoped to the package source #123
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | ||
|
Check failure on line 1 in .github/workflows/security-semgrep.yml
|
||
| # Front-Matter for GitHub Workflow | ||
| title: "Security Semgrep Workflow" | ||
| name: "security-semgrep.yml" | ||
| description: "Run Semgrep security scans via Nox session using unified .semgrep.yml" | ||
| category: security | ||
| usage: "Trigger on push to src/**, tests/**, .semgrep.yml; on pull_request; and weekly on Sunday at 02:00 UTC" | ||
| behavior: "Executes Nox session \"semgrep\" (which installs Semgrep==1.119.0 and runs .semgrep.yml, producing a SARIF); fails on any findings" | ||
| inputs: "triggers: schedule, push, pull_request; secrets: none" # pragma: allowlist secret | ||
| outputs: "semgrep.sarif" | ||
| dependencies: "github/codeql-action/upload-sarif@v3" | ||
| author: "Byron Williams" | ||
| last_modified: "2025-04-19" | ||
| changelog: "Added pip cache; generate & upload SARIF via Nox session" | ||
| tags: [security, semgrep, ci] | ||
| --- | ||
| name: Security – Semgrep via Nox | ||
| on: | ||
| push: | ||
| paths: | ||
| - "src/**" | ||
| - "tests/**" | ||
| - "semgrep.yml" | ||
| pull_request: | ||
| schedule: | ||
| - cron: "0 2 * * 0" # Weekly on Sunday at 02:00 UTC | ||
| permissions: | ||
| contents: read | ||
| env: | ||
| SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} # pragma: allowlist secret | ||
| SEMGREP_DEPLOYMENT_ID: ${{ secrets.SEMGREP_DEPLOYMENT_ID }} # pragma: allowlist secret | ||
| jobs: | ||
| prepare: | ||
| name: Prepare uv & Assured OSS | ||
| uses: ./.github/workflows/prepare-uv.yml | ||
| with: | ||
| GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }} | ||
| secrets: | ||
| GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }} | ||
| semgrep: | ||
| name: Run Semgrep scans | ||
| needs: prepare | ||
| runs-on: ubuntu-22.04 | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| - name: Verify no public PyPI fallbacks | ||
| run: uv run nox -s verify_assured | ||
| - name: Run Semgrep session | ||
| run: | | ||
| if [ "${{ github.event_name }}" = "pull_request" ]; then | ||
| uv run nox -s semgrep_ci | ||
| else | ||
| uv run nox -s semgrep_full | ||
| fi | ||
| - name: Upload Semgrep SARIF (PR only) | ||
| if: github.event_name == 'pull_request' | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: docs/reports/sarif/semgrep-ci.sarif | ||
