Skip to content

[SEC-6012] Enabling code scanning via Semgrep and triage via claude #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
randall-wyatt merged 3 commits into from
Aug 20, 2026
+59 −0
Merged

[SEC-6012] Enabling code scanning via Semgrep and triage via claude #15

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
164c6f6
[SEC-6012] Enabling code scanning via Semgrep and triage via claude
randall-wyatt Jul 21, 2026
27c2445
commenting out triaging
randall-wyatt Aug 17, 2026
1cc7271
removing the commented out code
randall-wyatt Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 59 additions & 0 deletions .github/workflows/code-scanning.yml
View file
Open in desktop

@cruhland cruhland Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of needing to duplicate this CI workflow in many repos, have you looked into reusable GitHub Actions workflows? You can define them once, in a specific repo, and then "call" them from workflows in other repos. Search for kube-e2e in the Iterable GitHub organization for examples.

Or, you could even define an Action that can be used in any of our repos, like our existing security-custom-action or launchpad-publish-image-action.

Either way, it would mean that you'd only need to make a tiny stub workflow in each repo that has minimal configuration.

Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
name: "Code Analysis"

on:
push:
branches: [ "master" ]
pull_request:
branches: [ "master" ]
schedule:
- cron: '0 0 * * 1' # Runs every Monday at midnight, this is to ensure that there is at least 1 scan every 7 days.

workflow_dispatch:

concurrency:
group: codeql-${{ github.ref }}
cancel-in-progress: true
Comment on lines +13 to +15

@cruhland cruhland Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This repo is very infrequently modified so it's not a big issue, but github.ref is the unique name of the branch that triggered the CI workflow. For pull_request events that's what you want, but for push events you typically don't want later commits to the main branch to cancel jobs running on earlier commits. Take a look at the bazel-ci.yml workflow in the BE repo for an alternative.


jobs:
analyze_scala:
name: Analyze Scala
runs-on: ubuntu-latest
permissions:
security-events: write
packages: read
actions: read
contents: read
id-token: write
checks: read
pull-requests: write

container:
# A Docker image with Semgrep installed. Do not change this.
image: semgrep/semgrep

# Skip any PR created by dependabot to avoid permission issues:
if: (github.actor != 'dependabot[bot]')

steps:
- name: Checkout repo
uses: actions/checkout@v4
with:
persist-credentials: 'false'

- name: Fetch forked ruleset
uses: actions/checkout@v4
with:
repository: 'Iterable/semgrep-rules'
path: .scala-security
sparse-checkout: 'scala'
token: ${{ secrets.GITHUB_TOKEN }}

- name: Run Semgrep
run: semgrep scan --config .scala-security/scala --sarif --output semgrep.sarif

- name: Upload SARIF results to GitHub Code Scanning
uses: actions/upload-artifact@v4
if: always()
with:
name: semgrep.sarif
path: semgrep.sarif
Loading