From 37eb0608fb7b943289dd8dcf48c65d56f58f8158 Mon Sep 17 00:00:00 2001 From: msukkari Date: Fri, 24 Jul 2026 07:58:44 -0700 Subject: [PATCH 1/5] fix: authorize vulnerability alert reads --- .github/workflows/vulnerability-triage.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/vulnerability-triage.yml b/.github/workflows/vulnerability-triage.yml index b2236b873..433fa62b4 100644 --- a/.github/workflows/vulnerability-triage.yml +++ b/.github/workflows/vulnerability-triage.yml @@ -9,6 +9,7 @@ permissions: contents: read packages: read security-events: read + vulnerability-alerts: read id-token: write jobs: From 373c2538fa230ff4cbd1067d187cc3b4d884323c Mon Sep 17 00:00:00 2001 From: msukkari Date: Fri, 24 Jul 2026 08:04:23 -0700 Subject: [PATCH 2/5] fix: use public Semgrep rules --- .github/workflows/semgrep.yml | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 2c1714b10..356623230 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -15,23 +15,15 @@ jobs: actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status runs-on: ubuntu-latest container: - image: returntocorp/semgrep + image: semgrep/semgrep steps: - uses: actions/checkout@v4 - - name: Checkout semgrep-rules repo - uses: actions/checkout@v4 - with: - repository: sourcegraph/security-semgrep-rules - token: ${{ secrets.GH_SEMGREP_SAST_TOKEN }} - path: semgrep-rules - - name: Run Semgrep SAST Scan - run: | - mv semgrep-rules ../ - semgrep ci -f ../semgrep-rules/semgrep-rules/ --metrics=off --oss-only --suppress-errors --sarif -o results.sarif --exclude='semgrep-rules' --baseline-commit "$(git merge-base main HEAD)" || true + run: semgrep scan --config auto --metrics=off --oss-only --suppress-errors --sarif --sarif-output=results.sarif + - name: Upload SARIF file uses: github/codeql-action/upload-sarif@v3 with: - sarif_file: results.sarif \ No newline at end of file + sarif_file: results.sarif From 87668886f39f642ca6a3473742b5616427696a3b Mon Sep 17 00:00:00 2001 From: msukkari Date: Fri, 24 Jul 2026 08:05:54 -0700 Subject: [PATCH 3/5] fix: use supported Semgrep scan flags --- .github/workflows/semgrep.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 356623230..765500a5b 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -21,7 +21,7 @@ jobs: - uses: actions/checkout@v4 - name: Run Semgrep SAST Scan - run: semgrep scan --config auto --metrics=off --oss-only --suppress-errors --sarif --sarif-output=results.sarif + run: semgrep scan --config auto --metrics=off --sarif --sarif-output=results.sarif - name: Upload SARIF file uses: github/codeql-action/upload-sarif@v3 From 3c850009ba663332ac9f412853c812c2d2bf35aa Mon Sep 17 00:00:00 2001 From: msukkari Date: Fri, 24 Jul 2026 08:07:18 -0700 Subject: [PATCH 4/5] fix: use default Semgrep registry rules --- .github/workflows/semgrep.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 765500a5b..c701bd7b8 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -21,7 +21,7 @@ jobs: - uses: actions/checkout@v4 - name: Run Semgrep SAST Scan - run: semgrep scan --config auto --metrics=off --sarif --sarif-output=results.sarif + run: semgrep scan --config p/default --metrics=off --sarif --sarif-output=results.sarif - name: Upload SARIF file uses: github/codeql-action/upload-sarif@v3 From 4694438b601ee8ff6768d1d3dc87b8c94a768f76 Mon Sep 17 00:00:00 2001 From: msukkari Date: Fri, 24 Jul 2026 08:13:31 -0700 Subject: [PATCH 5/5] fix: preserve differential Semgrep reporting --- .github/workflows/semgrep.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index c701bd7b8..846a23f2c 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -19,11 +19,14 @@ jobs: steps: - uses: actions/checkout@v4 + with: + fetch-depth: 0 - name: Run Semgrep SAST Scan - run: semgrep scan --config p/default --metrics=off --sarif --sarif-output=results.sarif + run: semgrep scan --config p/default --metrics=off --sarif --sarif-output=results.sarif --baseline-commit "${{ github.event.pull_request.base.sha }}" - name: Upload SARIF file + if: always() uses: github/codeql-action/upload-sarif@v3 with: sarif_file: results.sarif