zeroclaw/.github/workflows/ci-code-analysis.yml at master · EyrieCommander/zeroclaw · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# Static analysis — fast Semgrep pattern checks on every PR and master push.
#
# Semgrep: fast pattern scan (injection / path-traversal / unsafe patterns, plus
#   config-layer surfaces CodeQL does not cover — GitHub Actions YAML, Dockerfiles,
#   shell, HTML). On PRs it runs diff-aware (--baseline-commit) so only findings the
#   branch introduces are reported; on master push it does a full scan. Results upload
#   as SARIF to the GitHub Security tab. Report-only (no --error) — surfaced, never
#   gating. .semgrepignore suppresses known false-positive surfaces (tests, examples,
#   docs theme).
#
# Deep CodeQL taint analysis (Rust and JS/TS) lives in the sibling codeql.yml
# (master push + daily schedule + manual dispatch). It is deliberately not
# PR-triggered — see the rationale there — which also keeps it from rendering
# as a permanently skipped check on every PR.

name: Code Analysis

on:
  pull_request:
    branches: [master]
  push:
    branches: [master]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:

  # ── Fast pattern analysis (every PR, ~1 min) ─────────────────────────

  semgrep:
    name: Semgrep
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      security-events: write   # upload SARIF to the Security tab
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0   # full history so diff-aware --baseline-commit can reach the PR base
      - name: Run Semgrep CE (diff-aware on PRs, full scan on push)
        run: |
          set -euo pipefail
          baseline=""
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            # pull_request.base.sha can remain stale as master advances. Derive the
            # actual PR boundary from the checked-out merge commit and current base ref.
            baseline_commit="$(git merge-base HEAD "origin/${GITHUB_BASE_REF}")"
            baseline="--baseline-commit ${baseline_commit}"
          fi
          # Digest-pinned image (same one the container: field used), run via docker so
          # the SARIF-upload JS action can run on the host runner afterwards (the semgrep
          # image has no node). safe.directory clears git "dubious ownership" for the
          # root-in-container vs runner-owned mount. Report-only: no --error, never gates.
          docker run --rm -v "${PWD}:/src" -w /src \
            -e SEMGREP_SEND_TELEMETRY=off \
            -e SEMGREP_VERSION_CHECK=off \
            semgrep/semgrep@sha256:06938c1f365d3f67b8cedd8bc117607ae64253f88a0e768e9da9408548927dd6 \
            sh -c "git config --global --add safe.directory /src && \
                   semgrep scan --config auto ${baseline} --sarif --output semgrep.sarif"
      - name: Upload SARIF to code scanning
        if: always()
        # Fork PRs may have read-only tokens; trusted-event upload failures stay visible.
        continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork }}
        uses: github/codeql-action/upload-sarif@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
        with:
          sarif_file: semgrep.sarif
          category: semgrep