Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(static-analysis): unpausing and refractoring semgrep checks #37

Closed
wants to merge 2 commits into from
Closed

fix(static-analysis): unpausing and refractoring semgrep checks #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
32f4390
fix(static-analysis): unpausing and refractoring semgrep checks
pkanoongo Nov 22, 2024
da8d48f
fix(static-analysis): updating the path on the test file
pkanoongo Nov 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,6 @@ jobs:
- uses: open-turo/actions-gha/test@v2
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
- uses: ./static-analysis/semgrep
- uses: ./static-analysis
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the path here.

with:
semgrep-app-token: ${{ secrets.SEMGREP_APP_TOKEN }}
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,13 @@ See usage [here](./docker-build/README.md#usage).

Documentation is found [here](./docker-build/README.md).

### action: [`static-analysis/semgrep`](./static-analysis/semgrep)
### action: [`static-analysis`](./static-analysis/)

Scan code changes for security vulnerabilities

See usage [here](./static-analysis/semgrep/README.md#usage).
See usage [here](./static-analysis/README.md#usage).

Documentation is found [here](./static-analysis/semgrep/README.md).
Documentation is found [here](./static-analysis/README.md).

## Get Help

Expand Down
0 static-analysis/semgrep/README.md → static-analysis/README.md
View file
Open in desktop
File renamed without changes.
19 changes: 9 additions & 10 deletions static-analysis/semgrep/action.yaml → static-analysis/action.yaml
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a new breaking change. Since the action definition when being used has to be changed and people will now get something like an action not found error.

Something like this in the previous v2

image

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there are 2 options:

  • Keep the file name as is
  • Create a breaking change and rename the file -> Maybe this one is better as that way consumers don't need to know that it's semgrep this action uses? (but if we add more tools running them in parallel will require refactoring the action so things can run in parallel)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think option2 is better. We will add instructions in our breaking change doc.

Original file line number Diff line number Diff line change
Expand Up @@ -14,14 +14,13 @@ runs:
- name: Checkout
if: ${{inputs.checkout-repo == 'true'}}
uses: actions/checkout@v4
- run: echo "pausing checks"
- run: |
docker run --rm -v "${PWD}:/src" \
-e SEMGREP_APP_TOKEN=${{ inputs.semgrep-app-token }} \
-e SEMGREP_REPO_NAME=${GITHUB_REPOSITORY} \
-e SEMGREP_BRANCH=${GITHUB_REF} \
-e SEMGREP_COMMIT=${{ github.event.pull_request.head.sha }} \
-e SEMGREP_PR_ID=${{github.event.pull_request.number}} \
returntocorp/semgrep:latest-nonroot \
semgrep ci
shell: bash
# docker run --rm -v "${PWD}:/src" \
# -e SEMGREP_APP_TOKEN=${{ inputs.semgrep-app-token }} \
# -e SEMGREP_REPO_NAME=${GITHUB_REPOSITORY} \
# -e SEMGREP_BRANCH=${GITHUB_REF} \
# -e SEMGREP_COMMIT=${{ github.event.pull_request.head.sha }} \
# -e SEMGREP_PR_ID=${{github.event.pull_request.number}} \
# returntocorp/semgrep:latest-nonroot \
# semgrep ci
# shell: bash
Loading