Repository navigation
ci: remove per-repo Semgrep scan (the Semgrep Code app covers PRs) - #372
Conversation
The semgrep-code-hyperpolymath GitHub App (Semgrep Managed Scans) already reports semgrep-cloud-platform/scan on every pull request here, so this workflow scanned the same code twice. No Semgrep context is required by any ruleset. actions.lock loses only the Semgrep-specific entries. The edited workflow is rewritten as KYAML with standards scripts/kyaml-format.sh (yq -p yaml -o kyaml), which refuses any rewrite that changes the parsed data. Owner ruling 2026-10-08: a workflow touched by a PR is converted in that PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013aSu89DNALjTYHBvA6FcoM
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (26)
|
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title clearly and concisely describes the main change: removal of the repository's duplicate Semgrep scan because the Semgrep Code app covers pull requests. |
| Description check | ✅ Passed | The description directly explains the Semgrep workflow removal, the duplicate pull-request scanning, verification steps, and the known coverage change. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
- Commit to this branch
- Create a new PR
- Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hypatia found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
🔍 Hypatia Security ScanFindings: 269 issues detected
View findings[
{
"reason": "Action `\"actions/checkout@v6.0.1\",` in ci.yml is not pinned to a commit SHA — `v6.0.1\",` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.",
"type": "unpinned_action",
"file": ".github/workflows/ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action `\"dtolnay/rust-toolchain@stable\",` in ci.yml is not pinned to a commit SHA — `stable\",` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.",
"type": "unpinned_action",
"file": ".github/workflows/ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action `\"actions/cache@v4.2.3\",` in ci.yml is not pinned to a commit SHA — `v4.2.3\",` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.",
"type": "unpinned_action",
"file": ".github/workflows/ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action `\"actions/checkout@v6.0.1\",` in ci.yml is not pinned to a commit SHA — `v6.0.1\",` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.",
"type": "unpinned_action",
"file": ".github/workflows/ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action `\"erlef/setup-beam@v1.18.2\",` in ci.yml is not pinned to a commit SHA — `v1.18.2\",` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.",
"type": "unpinned_action",
"file": ".github/workflows/ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action `\"actions/cache@v4.2.3\",` in ci.yml is not pinned to a commit SHA — `v4.2.3\",` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.",
"type": "unpinned_action",
"file": ".github/workflows/ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action `\"actions/checkout@v6.0.1\",` in ci.yml is not pinned to a commit SHA — `v6.0.1\",` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.",
"type": "unpinned_action",
"file": ".github/workflows/ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action `\"actions/setup-node@v4.0.2\",` in ci.yml is not pinned to a commit SHA — `v4.0.2\",` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.",
"type": "unpinned_action",
"file": ".github/workflows/ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action `\"actions/checkout@v6.0.1\",` in ci.yml is not pinned to a commit SHA — `v6.0.1\",` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.",
"type": "unpinned_action",
"file": ".github/workflows/ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action `\"ludeeus/action-shellcheck@2.0.0\",` in ci.yml is not pinned to a commit SHA — `2.0.0\",` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.",
"type": "unpinned_action",
"file": ".github/workflows/ci.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
## Summary Restores block-style formatting of `.github/workflows/ci.yml`. #372 removed this repo's duplicate Semgrep scan and, in the same PR, rewrote the file as KYAML. The KYAML form turned two gates red that read only block YAML: - **governance / Workflow security linter**: its duplicate-key check comes from standards@317101e0 (2026-09-14). Flow-document support landed later, in standards 13b872c1 (2026-10-01), so the old copy reads every step's `name:`/`run:` as a repeat of the previous one and reports phantom duplicates. - **lint-workflows** (this repo's `workflow-linter.yml`), where present: it checks for top-level permissions with `grep -q "^permissions:"`. KYAML indents that key inside `{`, so the check fails although the permissions are declared. The parsed workflow is unchanged, so behaviour does not change. KYAML conversion waits until both gates read it. Follow-up to #372. ## Type of change - [ ] 🐛 Bug fix: no code change; this clears CI reds the earlier reformat caused. - [ ] ✨ New feature: n/a - [ ] 💥 Breaking change: no - [ ] 🕳️ Soundness fix: n/a - [ ] 📖 Documentation: n/a - [x] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance: n/a - [x] 🔧 Build / CI / tooling ## 📌 New pins Head SHA: **`c59230581179e6803cbb36ecb17d3ea349e1827c`**. No pins added or changed. ## How has this been verified? - `yq -o json 'sort_keys(..)'` on `main` @ `50bacde` and on this head: **identical data**. - The current standards duplicate-key checker passes this file. A planted duplicate in a KYAML copy is still caught (rc=1), so the KYAML file was clean and the old checker was wrong. - `grep -c '^permissions:'` = 1 (was 0 in the KYAML form). - `actionlint`: same diagnostics as the pre-#372 file. - No `uses:` ref changes, so `actions.lock` is unaffected. ## Checklist - [x] My commits are **signed** (verified `G`). - [x] I ran the project's own checks/tests locally and they pass: the checks above. This is formatting only. - [ ] New files carry the correct SPDX identifier: n/a, no new files. - [x] Docs are updated, and no public claim now overstates what the code does: nothing to update. - [x] I have not introduced a soundness hole. ## Notes for reviewers Formatting only. The data-identity check is the whole claim. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_013aSu89DNALjTYHBvA6FcoM Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Summary
Removes this repo's own Semgrep scan. The
semgrep-code-hyperpolymathGitHub App (Semgrep Managed Scans) already reportssemgrep-cloud-platform/scanon every pull request here, so PRs were scanned twice. No ruleset requires a Semgrep context in this repo (checked viarules/branches/main).No issue. This is owner-requested estate cleanup (duplicate Semgrep scanning).
Type of change
📌 New pins
Head SHA:
96dc5281ed5d8f30378af9747faf606d3074c544. No pins added or changed.returntocorp/semgrep-action@v1How has this been verified?
Files:
M .github/workflows/actions.lock
M .github/workflows/ci.yml
actions.lock: only the Semgrep-specific entries removed (thesemgrep.ymlworkflow key and/or thereturntocorp/semgrep-actionlist item and its dependency block). Every other entry, transitive dependencies included, is untouched.gh actions-lock --no-fix --json: findings diffed before/after. 0 new findings; only findings that belonged to the removed Semgrep entries disappeared.yq -e .parses every changed YAML file.standards/scripts/kyaml-format.sh(yq-p yaml -o kyaml), which refuses any rewrite that changes the parsed data;kyaml-format.sh --checkpasses. Owner ruling 2026-10-08: a workflow a PR touches is converted to KYAML in that PR. The diff is large because of the reformat; the only semantic change is the removed Semgrep step/job.actionlint: same diagnostic count as the original file (no new lint).Checklist
git commit -S, verifiedG).Notes for reviewers
Coverage change, stated rather than hidden: the removed workflow also ran on
pushandschedule. The app reports only on pull requests: nosemgrep-cloud-platform/scancheck exists onmainHEAD8d43f44. Default-branch and scheduled full scans now depend on Semgrep Cloud's own schedule, which is not verified from GitHub.The removed job used
p/security-audit,p/secretsandp/owasp-top-ten; those rules now apply only if the Semgrep Cloud policy enables them..gitlab-ci.ymlandsecurity/static-analysis/run_semgrep.share not GitHub CI and are left alone.🤖 Generated with Claude Code
https://claude.ai/code/session_013aSu89DNALjTYHBvA6FcoM