ledgerbase/.github/workflows/security-semgrep.yml at cacd2e316e32bcbd85128a024a968bcb46483ce6 · williaby/ledgerbase · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
---
# Front-Matter for GitHub Workflow

title: "Security Semgrep Workflow"
name: "security-semgrep.yml"
description: "Run Semgrep security scans via Nox session using unified .semgrep.yml"
category: security
usage: "Trigger on push to src/**, tests/**, .semgrep.yml; on pull_request; and weekly on Sunday at 02:00 UTC"
behavior: "Executes Nox session \"semgrep\" (which installs Semgrep==1.119.0 and runs .semgrep.yml, producing a SARIF); fails on any findings"
inputs: "triggers: schedule, push, pull_request; secrets: none" # pragma: allowlist secret
outputs: "semgrep.sarif"
dependencies: "github/codeql-action/upload-sarif@v3"
author: "Byron Williams"
last_modified: "2025-04-19"
changelog: "Added pip cache; generate & upload SARIF via Nox session"
tags: [security, semgrep, ci]
---

name: Security – Semgrep via Nox

on:
  push:
    paths:
      - "src/**"
      - "tests/**"
      - "semgrep.yml"
  pull_request:
  schedule:
    - cron: "0 2 * * 0"  # Weekly on Sunday at 02:00 UTC

permissions:
  contents: read

env:
  SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} # pragma: allowlist secret
  SEMGREP_DEPLOYMENT_ID: ${{ secrets.SEMGREP_DEPLOYMENT_ID }} # pragma: allowlist secret

jobs:
  prepare:
    name: Prepare uv & Assured OSS
    uses: ./.github/workflows/prepare-uv.yml
    with:
      GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
    secrets:
      GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}

  semgrep:
    name: Run Semgrep scans
    needs: prepare
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Verify no public PyPI fallbacks
        run: uv run nox -s verify_assured

      - name: Run Semgrep session
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            uv run nox -s semgrep_ci
          else
            uv run nox -s semgrep_full
          fi

      - name: Upload Semgrep SARIF (PR only)
        if: github.event_name == 'pull_request'
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: docs/reports/sarif/semgrep-ci.sarif