From e66f98433c5306559ac541623957fc8935161373 Mon Sep 17 00:00:00 2001 From: rgarcia <72655+rgarcia@users.noreply.github.com> Date: Sat, 14 Nov 2026 02:33:18 +0000 Subject: [PATCH] Pass Semgrep inputs to the scan step through env --- .github/workflows/semgrep.yml | 10 ++++++++-- .../__pycache__/semgrep_triage.cpython-314.pyc | Bin 0 -> 19433 bytes .../test_semgrep_triage.cpython-314.pyc | Bin 0 -> 31765 bytes scripts/test_semgrep_triage.py | 8 ++++++++ 4 files changed, 16 insertions(+), 2 deletions(-) create mode 100644 scripts/__pycache__/semgrep_triage.cpython-314.pyc create mode 100644 scripts/__pycache__/test_semgrep_triage.cpython-314.pyc diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 55c0b38..1852ba1 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -36,6 +36,9 @@ jobs: fetch-depth: 0 - name: Run Semgrep + env: + EXTRA_CONFIGS: ${{ inputs.extra-configs }} + BASELINE_COMMIT: ${{ github.event.pull_request.base.sha }} run: | # Replaces the registry's github-actions-mutable-action-tag rule, which only accepts # commit SHAs. Workflows lock action commits in actions.lock, so an exact vX.Y.Z tag @@ -72,6 +75,9 @@ jobs: - pattern-not-regex: '@[0-9a-f]{40}(\s|$)' - pattern-not-regex: '@v[0-9]+\.[0-9]+\.[0-9]+(\s|$)' RULE + # EXTRA_CONFIGS is a space-separated list of flags, so it is split on purpose. + set -f + # shellcheck disable=SC2086 semgrep scan \ --config p/security-audit \ --config p/owasp-top-ten \ @@ -79,9 +85,9 @@ jobs: --config p/github-actions \ --config "$RUNNER_TEMP/github-actions-mutable-action-tag.yml" \ --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag \ - ${{ inputs.extra-configs }} \ + $EXTRA_CONFIGS \ --severity ERROR --severity WARNING \ - --baseline-commit ${{ github.event.pull_request.base.sha }} \ + --baseline-commit "$BASELINE_COMMIT" \ --json \ -o semgrep-results.json || true diff --git a/scripts/__pycache__/semgrep_triage.cpython-314.pyc b/scripts/__pycache__/semgrep_triage.cpython-314.pyc new file mode 100644 index 0000000000000000000000000000000000000000..5ae03e16a0a3fbee5345ac1511e81b27e163b61b GIT binary patch literal 19433 zcmch9e{@sVo#%Vf(+}&1E%_%HV+&(`7_bf41!5DxU>k_Bab#JB#8?PRwgt8&-jn&E zW?J{hwkFvQPMR*tG(B;4+KFk?#c4Yy?vHaqcQa?`PS5li8RRJRBztDg%<0*GUz2Dzgn{%xu4x#DB$EO?DbKF1BgBo;7hQIIQ zIc|b;a$&BYbMlAzLz=Lrg7TWf+OU?TLRes_F05mzKCEY{A#6aZJ#0Lb6V736gu|vo z=CB!gUD#5@t>K)y63(eVVQtVV-wWrmQUgkj4Vq+Go-+r}rV?(%7Pg(xbycc^OsD9{ z+<=i%2GGyMe0~9 zu#RilU$w*Q!h{b7!iUCBIi!Hk?+6Y$!oz+?w|{g<^oJZ_G2k8YJMcFa-r^9)#~i0F zIwa*~?ZwfNT9fJIkQXh)laA5gIlr`|^PL zc*n;4K1XmY9Ave+oQ`3?*SE!SemF2NYzj!oc*73Se=guZ&st+RlEW+d9ib8L0BgF% z;T`ii&WnL?au8k44U$^dduqh*7zvEw71i=z2uNWJ%n=x)LKBUL^*9(5*#Ovl9T<&> zVbq#VhJsS~q+?*%KX68wA*+D?pXxr^iAvJ=NEnOc4U9?QtShiZotG~#IH(L2iy=R7pIjE~gbN#|j64vQ{3C;oVbmB4I+FVv z4xaIkIWR+M*grDTgtj9W>1z_Y7{>$*tkxxr9?zI})bH^mOdii@&^JCp zd5gz$cHBFXe3R$#3!P#CFl6g+3*SC@bTh=7)JF@6{o!$OEFp9P&e;|LeDpY^qu#JYAE^{`sR_0`32OuZ z1%d&Rzz#aRlE9EbhPit@PJ^E(DwZ4`TO`u z{fB0I++2qLvbpR|{_5!9Yoo7>#>={04f1jD?&i9Z3^A&w0-Yy7IQpTWLV5@%%*OR-dxUXqEjO-d1Js_aw{dM) zn6oXN+IF0j9Il*e2fCzmTpJQXKo#R)tCf5JNGxKisR?<90%P8=pCD5j85cvG1}rF_;@^k z5YH`Du$d9Paq~oC+WYl-a>nKGP!q2T!>bL+>$uf ziOd9@lB}nP_|8Y3An++TLBe*O8{C7+IY4OE6YY)|YidUQ;o+bU^32h0SH`{?amHx= z62Q`d&v#a97`jwgL~Z&wiAV8PqG7LB`9$jg zWSlCEx~I?2gs)w^dU58=T*>v~>&6>KdEL|UvHnTpZKH>6vq+LiwM8VpN2CQ3Nd+Sk zlanxbJig!n3J)&=L?+M2q2wcJ__R59l9K_Q6Z10$im2YNbjA0t+GR_Twr`nTh5kR#%EMKh6CZP&dKVaUtH# zfeQaE$AvVHqxYcenyeIGqhj(Venav@L-xv*6Zt zrMO(RjN|%KytDev$F}&4(WQG6U2fgdv9~|Pfm83wkO0(C;M56QNK{LPT258UW#hYh zTiiP0Pt?%QZz1SThT7EVD!BHqC3&FVD5;yrdDcZ-o&NJRM8ueW$RT>iz|N2w%SL1 z3Rnh3`}QStU_u9m6I{YbV<4qPwK1U){qzjwS(tc{AwT4U4h6^Rh9HlJAPM-v+Yfrd zu_yH2P{=>#gV;wW0E`;xxf1+ff*&Q;-z%aDx*iG-O9Udsn5nFpJxNtaKjvZW#9>rn z;6IJb1oz>_O%tu}Tk|LRJNAMrt6o|quReIg{=1^z6x}%gcjfWJCuID8_QZn68}|&% zdj@XXeUr_1$||P$Hw>>EX86A}efQ{_-Lv+$OWrD(v;Va8?TXooxwEmF=BXVYaq2KIFRU`wYFA87pdA96BG289AyaP7*{*M%dJssDyXa-pqnAs8BPjZ+BiTrmRw2okD1Y%K(=SFZ8rf z!880;)3f#D7Et@BSsfMWLKkb_HJ>T+y)qctK>cQ7KUg?;rij~#L zC3RD0<0X_Xt}K0R#VaemTYBlK$>ymwixzv_QZ{cXi@K(_$1LmPmYR7>&70EfwjZ7Q znKZZUogH&KuJb?r;=2cK@c*stw+G~|r{i628UK6Sf7dS89=mNhe$UL=EALv;2y6*X zqLs#h{9Nk3C49JqhHQ~V5xGbO<98m7j2M#?F#$z6o^xdASF>vci77gcKdBOt!W69_ zCTPV}J@G^<7vAZ?Tj$=-^#CH%GlBG0;Jd z>#cI@GuekF3QA4;G35mIYBI+GCPEW&^}+%M16Y_TBn--{O~kC?YeEQ2Ixoa-|6{Q=ku-ia=4N*BEhzA?Usd-G(`gaVd0Mf;w3t3 zLsAPVcA=kyKvuvssr^jxks#EEzm(p(kl%QZLlhmmOUW!`NF;Netngs~C7Ff+=<@*E z39e6_3dxWtUml>BvcU?KC)z&K#%7X?F8Yi_=oSClZhbb{q7H1z0p4k&bm`1dYIhszc%=F4?UIqw+diNyCG=iUXG-n0Un8Y5|T!ILKFF`fvfc2O<>~d~#NI@03DGE|zA?RJEJ>Nt<5ekDPIc4yt z6TCsHb+oCj06>6>6cr|ue#)+#IU)rEl6BuF1|i${wwR>A*nl#=E~mp6#Nc3BhJk(@ z6Tmn|RWtNOnhw2!IF^)cn0G*}N&FJFL*Y2I;CvzlH8o&l{GxXRI&X+ZA^(6B(bNn? z3I~FszxM2SFzoNbizf%YBa)x7EfFm^rHG}bW-M4EGFeTESlJWIGc`2xSn+Kfj@Qdd<|}mBUkqk)1EtAF~{o zXuV@Dy1eK4J<%`7l{@DO<-I*}?+MxCTU=E=vv=<34VT<~Tz=MbSIe&o@QbI0l+1_K zHM1?(g^zR^OB?^sZAX4Rcvr{iaz4^?){?1k%u+_2ofVv&wea$@m!6HToZf%ix&Z>I zZAH``-TA%J>9$)dH_!B3JAU=}?Af{EzrJ|AGFHTI;= zI~S()w@Nn56kS_+b>-}~S@&OKLb2-RSnmFKZo8b@e%%j47L;q|OJ=AViw^KpXO%R% zL0-FW+B;+T!D(b>*Uzn+U%PLys8lX%j-H(^`rZX(W{Q7SFx&IfiutnUds=Gzzc@ap zg$KWvyYX%=XW2M8B%3!(U7W6(H*b)I4WInWDz5MV&+Hd}VQ=M(OBg``I{>u!SmU{- zj*RDmV!tq|YGQFenk$-D;tU?8DJQB));!69i1<1U-wCBF#j>LT_AJUg(V>*2={zd4 zK**YnF@ekkkQhiIKMrXMr0^LK5BPC_XmLx>ILudFDdMVhL$Nc37NMHWUL!?3olwzc z?IT6x9!B$ZS*2lTN}j6|IyLRk(Ip9W8VU12!g_`{l(T9LiUG2bjWFg4+Lv)?gT;g} z4lF@dGQ7iT(-DUL_XQ-3NmF$CicvM8s$D!I!2!iTMtl(!*+vABnc)6M%aQw9-qOjx z*K%a;EI6{R+@LMfulsujrzK z-?he9Y?fDSp2?4wY@ILJI$IJec>>*8o6s8|6Wx*?y_5gsUpRV@EcoVsXf`%)6n>ps zf_MoW(o43-TiM7SZCgz;D{x9t*p)g`m|GOxY!%un8smMGYetmN!Wb>0XD$Pa71AT~ zQFyGqfIxQwf6^Y7`Ir;=6t8(OVd|q0^no*O!zbwGBL7Poqs;W3tt^%B1aztv0 znqq{+jiq=(E-Po7F$!YimxVQ4T6qB;GR5VjtEK%f)bIB5POZ91Y8e}g@F$O@K>aSp zLSVBjeBQAzpD4WxemsT{_zpN1CXCEU&=WlKX>o><6g&fztF`2IL9R$(YEU^+tU46d zsOXo~=&UwF9dgDO5ECZmnCKzKfSJ?98jMsVLM!e>i;RI%cfrWz| zpnX*EZHiKKpAiq3kyJyHUh&2hUq!76{7HYsGK+%Yn}@%0c*-~JnmD{5Y+4k|aiMr# zD1JG7CGt{ap>q4r8s2XFN#op5e9zJOJx61Eo{rT!W!JG-P zum_Upm)KK!bg0WhN~Q6C6daM2z^JD)#PualB~Bg9YgvFZF>FN{b+Vj2)tVFH`;2Py zuI!j1WhwGO!2v~VR!d7-NeN|0hA&CR3D@*Nk)i|@t87R<`_@y>nRUBTr%`PKvYsN^ zeT3UtSl-hRNDO)^QQtdLs$O_eX}ZWGZCP-_`CIJ;l5|=N~+4KzLwIep}?3&Id{8HL6N47GOzqLCz_q!BWXU-1(To;vLx zfVvir7*gOA9BSb%Oo|~dL=_~1e#khrk_lXv z{{n;+$O#a797>-K(!sKRl8($?QS@F+7=m!KM#aebWX3T%4hLn(MqbEIV>M%bV2c1G zOK1W8Lw>P3Pb4BQf(-&n8ib>WqRi#H6{JO|N<2v~;ge0i&JZBs^g{*^#_%Md%ay_j zliNEo?q`m=ivG8mn!vR&I08PENkDowS)W)>J-&uWqBB8)Nz$VeXjme1IQgWBGkC|2 z=zl>53M{B~8!t7!uzRBAjy3Oc-}8NPDa4ImiSLAe9*$XCCfe>;?U$c<{+Vk#qWae? zuUMv^el>3vZ+7F2xoB$eRbSk^_NIC5n~k%BZ=Zha^!3u%jw8SI#W#1~+}wR9cZIz2 zKrFXKHnuG07RGZc=5s5ib7r>1a%(0IQv0D-C8hoMBeNTR)ezsX@8*Vm*AL$CzT3_k zlQuYq5n*=CS;gK>So4IqjMh1jp8l&|1<)2nTz{?I+9`gi7pX z6;#5cXnP%sI+$sO(^f0y(Zq~ZpY7K~4A;x}lc1)-E_}=t^F3g=D2{gCWvRU5DJ8SG zrs=Mh-h5cT{jQE>cJ|(58D&K>QD6@G1De;}Zvaa5n!IL65?V+SLXU1-%hYP{_&M8> zl?6*l4Y2>HD~#^ckVZfCaFA;QiaFb(B7~&g7l+#|IJKEFid$E&Iiqa{;$cp60AET& zdN|FI^333ddq`$|8`sLW{a?sCLLcU#1h?2Mgzel`(+>BGmsa^|v zTj6<(C}<9vLdNviy3Ktl^77EwpeY72PR*m+lqNP0)jjY~-4r=mUUvu_PiDVv<7bQk z`-Jr|eipl%+C?0rOfuv&q)Ap6h~M%6HaaCGI*pmTXyLY}h!yN@|C8go&2R+D={Dhw zHk6YlU`_nf!c&~jL0<+VYjT_GHSDgCk!%_&$tNew)F`o@P;i3vE{BtTM-jo3)6!wb zXdcm8Wt3ArfVeK1r`4T<(dBMW!Ak|8u)Pf`)D)pjj0 zu`Zc5DD@l>wNOJnn2x0Dt}Y}%KT#BU_JDeaiRo2gYa&yVH+9DCQTE-MN*t#N&c(Go1w?IMsyOP_?mC2v zgK5qd?bz{y-aK=em)aY;VVQvuanq8PI3UTEOVIw(mei&Ltt+?-+=LDY;fS)$PGK$g z1#N(bP)7Fav=&$VIv$foJ0YQ|-O6;b%HmPYB#SdKp|ChPyK$)wtem(fQHjeV;OJ65 zp0&G4F*G9WsZG^+ojSnb=Kl2$SRpz8^t?A9_nnw>f9Hv5VZNX$UeGHS^v>94cK*0@ zw(VAR(_A=S-MdiTd;RQWkzhqsVoF_!jaB%}6kz8OB{NJgD5Hvee>FsP0b@{UyCyhe%n)!p`}I zj;rfuDyN*$hIrAsg`#!S+mX%}t&25ue8PJ9+PaN=WObu*LU1n%N~_cXB3lG${d2m{ z1QgK6fnatKcAnHreRK`ayUb^dF}>B=PB>NA6n+1Hra{sG72y?32Pgg&MZ}UrvoC^4 zPwNhFe`M?;BA-vO2Ut3qk9iIp?dWLjbajj0pe9=Qen9_*W5S6)r07Q!y-5+7jT1a> zj)c9q6DUqnnS;u7=V>c5U=}otyi}7WgMIrH*v(r8u;M$Y_A>q?x-|941b5HKt*>3M z_+CFY&A+4jxo&Rom)7fN|91S><2O99gC}A;`)Ak0P7VCW{z>nY{#${l{e}Mdo&A^k zUq3d{I&bkUu31a^{(`Be;?|0JYXy}3N8EDnv4v;)<3~IiXGVcHF4Cwfm^t)FtOXy1?d($ zp|Skam!-?n^XbQU-szipr&*u%v#ql`B8xAGvQhHoJ(G@KW;g2uY${U+;zan zKV^Lx7jw#|_0tz`Ikx@mz#RXp`nm8gpLqAVTTR`u2G=czOE$Y?!S%`gb)41DOC~_V zWX)5B`d<_v`jfQDq)Rr!_$@GPviZ^4WIds&K$sn#gn^8p(7R=*mzh%8fPsCMDdfil z!aEU>cvHw*$ydNS=_bzsD_!qFGP9N?q)Nuq^)O51u5MOUk!?sZqy``~MTPZM9E=J0 zs$@78XhGn>5vn1Z`Me?dQsquUx;|Q57P4JUTf@18&(lvfbGH*$hg5DOWO(d%;GXbD zkKULzi@UgN>LM4f&Qwjocc&D)$9s=oY7ms!Gcxicmnp>`!+`_*G0BoFq%Ax2D*(9f zu6Jn^R|=P@P8+hg%xX&?)IepNi+FvL%iPcJIuD*wOJ(5H;c|g;Yaf{-SYSN2-eqy- zt;aKFkwraqyi8rkip&w&`iN+;;4-Q6Lx1*6PL;;$$nb?sOG)(_ee$+{NS`rJ-lbnE zxvYlLEu`P8@8{{3Kji|jVKr%2b6{HXBQ~a{s!^^M)`l;HBTqCo;+kMkY-}VgR_2v| zkT)N*v@2H&LB-B_M^L2bWf~owiX!?7<`jV^lfyeex4qeId-c+E%4?xEk)s?@Pr#SZ z`OiUdo-iaSmZI2l;3ovgiz?m8GDai8OCrpQT%?cx>eB>FK?SKZ;O>5irEiO>OV4aw!+Ji=OfV#@zTxn zrJG}=HL<+fc;5E;yzOMjkL5K_9J-TVd}Y&1o1#PV#(lTS_r+JY&#!Ket?r2BcTTkb zW1eF=Kfb1Zeog&sTWn2JEN?ejtk^K4pW7T;(KRm=O&t2bTyV!|m2Eajb8cK@!$6SdO-Gg<qZzK9x$ac3*Y06mstt z+FSN$-(8p6@`U!?Cv?a!Ay9-~aQGiRxLbeNn>0blE)f7JKbrTpO zoEp_!7t%P*(3^dgd5UYg=v&J|+Ao`3u1?|KbTzoK@wiBZ(NTbWoz+ttvU7^Ep}t`! z=Jc8MjeW$Mvhca;=lqfNO-o1J{`I7k&u62Z?zH(tm!@%WiOZsaQZYZA@N`{;>KxLk zQ_FtW1*#3uGXh%{di`CbfL#{QLrQCqeudJMX=6z#Od!hx>0Bu&RI+c4@&sSlM}03# zAAig!)bEjRK*B(n8b2sPmRG^&hwZ>9`p=FBL^wgcijhS0HSn|w1;Mk)^oYxMivJna z4`0OHRaUI4f%lad$)U>Z5<9gcS0;F1P&W*5;x{jh_(cR}SV-hHi$mk|n=f5tXAl#) z5TrbGyPiG5wVj@ohlGXlXvyk}>@*W>CQR%-y^$2xh64K3-&4dsx{oSpi3?@;|I74( zFnF~={4KrGC;Qjpy9t4={v`O2SV`5Y5GfwLu!tZiQkOu#03-e$?-;h=84!dvn#cV6m@HpDEBNq*6ob2;}? z?$m{us>$31W1adOc~d*`z|(WK1^>2fw3ut^AtJ9`T>h1l!C>Zy*AJ(A`-J5qJ5| kqC$78IKeU*SGvgDXu_kKA_8K`(2A?Er96K@NnQXM1Y)+vDq0}fFpG|T$lk7PwOFEg1&hDQ5 z{##w$)zAoOoXuW|+ts)3y>;u}|Nig$ch#~KJBM`k&Zn<#+re>vLtpeHL@pkmHgnt+ zu9Fk_16)A+tBCtq!N3(->Th}{chi&oJlCW%64MJ+ET<8w_dUu#CGos}j< zO7U51cAEk@qOG&Iv)*lT^P;_z@64jBT2mlbTp>DgxdA?qCzgv&c9oyam2zTAE+;P2 z-ziYQ%2H95*5PQ`5F3ep)qs_y6j&~%=W>A}RzCyvGnc4e%xY$#X7&;_OIXbu)XeQD zi9XN8O7l>fzeM{|RQzrb@o!HGG$RUAWy9S$Z}+8*=*oI0M-gPUPA!v^HKewV7(oE4bTc z$%-2iVFcB3*57^kHYYjpMW#lpR;^NZ*Y^1beYM_R-%x-J665O{k@^FdYYao~lKO`O za&5pT;|;a(dje8FTDgZWt4Uq{!9lc_($Hxk^`4FF3U}X`ajkJ|Rj7R2Hepd5>lMrT z$GE}8y#b*y_6C2?+O$W|0>`ySHaN$%Sg2KeiY8&sUmNAu?&Qn&cns4+MPO&6R>gGohOL{i<*r^E=dg;HbJR ze!|sM**8Ft7Huyy9cXSm(7f-s>ezGi$dSFxt-E#~-b>&k2P(}{Cc2aW+MFu*E};m$ z>Z>o&3#vA)Lx~V}3I62$$gXe?lJjn6+$wyx@Eb*Q$*X6RS3gKCnoF&@n_4p-oZK|^ zveI%=ai4nN-tZI0N3C}%KJ0vK=F?8_pPD&)1sdRgIC=F`nb7EW-Md`Y4_uC2b;(`$ z8cq5NKi-BSFP_=K1$dDIX<8XD=Wu=w$dzYE(juCG=B%O_xlObnPZF&Gp^Xb9i?$V9 zrJ&lIyytxT`UCq%&c?wP%_#na$E~=y!o}dLjn~(-jT?$VUGyrp=D4qqlyd`OhNw@L zM6CI3zPZvO5!kCXPf!1VPgav-i<2bzF7*2@%2;s==DA0;vMOv<;+H}2c>0I>10Ii> z8G9ACUbqVV%d|RJn4E&K_3xY;wS3j_Airp=?;FLqTy{S11JN)L7PXDRF1o<%{x2{{Eb~m^C{6RskR72P;bD% z+8#{ll6>BP&!gQ_^9*kkcc%`G>kgczk6hWuALsw`4R6xcLln90|OqZ%eyv`H?ypkBE z6KKcLDg`ZG#x8(~=;{mB?A+<9sjFV+s;aAQaP8b_cU`hqUA9wc{aRO5eO+}uN?ko8 zLtXZ&V9?$TG6JfD9)j6g(|T9c+Um8`w8m?%IUBT}?H}?=m)*ldz0JU14y>q83hX5y zkq8FW^au^2x$_X9$N)43=?q=5P3zJC+{Ji@zLBAG9?3h@3o!8yc>;Yt&k%O9+~4g} z*C$#C_fpM>H+@}`Bno5geaoA2gto?IEu-#NA6&M~Fs*qtWj#7X7lGfHc_a;QVu-FZ*&Xdp-1 zr@1moT8~eOo-A#oY!hXTlx?PL3uRl88DX3di$ocQi01;qH|4bXLTBSs6R15VyFX@~vfX%F$!N0a* zo0z*UcB|H|K3~^4by=5pI4~mlJm7SPN5H5Ce3t^KW0yzH4om(npDe3pX=DhT1>=T^ zp#=j8*dWeAwRojoS;OdSGz72@#S&#N;ZLqb1}f*sesjlHc8skbbB7wn+~Zx7S$DdX zmpf)0opTP~w8J;&I5+J$7j_IPmO(ak&xs87JOdeIH1!X46N7YgXur?fy#N*1Ff@h= zsxkLhzzm3{qx|RH^qp8IeRFq4uS$qQCs>uGP)Mga)|<}Qu)aPAI_k8?`sz&5$N0HN zmKE#mmmXPutgp`8xRHIH_bfK_w)~gwt;EnX_FoonyruboJr*c;B@GP!F;*uie* zPYd}s-E#$XcMIw!N+(W)3%1S(+ZMLVz^(kPlgDO+mln1woA8ATw#^9J7i}lb2s=OL z&3nSmr7?OZP4eOxU8LKT?ZKZBqbFN;0i#o{J%j2b#!U;vo)#T95u375;6aHX+5*X7 zU!Zql%z%9#GzdP4FjbJaO~~VM)FT-WXBg`*kS|R=bllHyT7+((hiGc!TL=fvOR-(u zPS0ZrHKQW6UdC~HO_4L|*C0|wdj z94(l>PZ#!|tG*y6$LeDoBzMnCpcjQlqhjZC^lBF!G4;ZdZ|M|MphL814}Ff_Q^hnf zJyw6wF)x3iF+0T!W3Nk&I#bNj-w|*Sg_$MWrGoXgJjdvZUU>A`v0j%PMGi)hE9Qwg zc;^V!W^|H}^SrcVUzuWlY$jTW3d~Ceno@w>U#wc7Nc5`~(i;R#HRthnR<#Uz`@wp3 z`GiHOrZg|2K^U&-7f!- zY8~`Ry}n>lP0f(Mrl$wJ4+d>iv9rFp()Kj9+t=e72G3Q|=ZC&(%hOaBlH>z}Ipm@u zm6Oh69-ca>qMwjm1!@UYYZxT2(kA)oHhtHdf%jy+RlDRqh@abAr4e5x>qW~XG>~Lu zmC3>M{=s3t6mZ3OS3^bWSsJE{h7fBUTuD!hHF47u+1TP9S?N@TfNyY^1U5CJ6<2-< z0#zeZ75k;jsvXn4XTawj8X1NbRlAUA1FIHoQ6#@VfEhdo?J{GKRqI9QW--%!U{4tv zpi_EtU~pJtsv~sXD*FN_hSjtffpD{uC;N z9W&o@+;GeYxS}+B>jYWmyJu||3>c)Q6emApYM(B*)9vSPN5mv;$UkYW9+h&B? z_!7&EP!sK7Xh!fGZ|96>%?R!XS-E4DTgf+)Lt7_o;jE1`bYrco&;`_rbn=Mfv$j9s z_~adb8-1Tkp`7uO8DVp*YvD(xHyI9??uxH6O=jDdh6vIFONGWPKEP#Oj-Uk z`Ge$p!a+?UA$CnqM0*$|zJrU!^l-qz#x{|*Mp`)x)&BEJa!^n}3fvg!5qQbe5~a`j zusFytEe2bcUJhP1!cmK+YP}GjdMVTqOo7r`X;PE0{h|MtBN}Fp|D4L(vALxn8ZZll zYSXGnuc1V>Ga&Ym*r-}w_4f}&6lAKEDG^i)(x6m=lN}4V6!1DMJ2?uz`vR%r*E}8P2O1Z_QM2phT2rkBm^w+D1cAxVo_ z9Y3$+*G;US+%VN}CmX5`WsCR_TKiV;t9){+#;?Y)k16PkO@JK?+UEz_mI&j8-l9oo z-x3MC`aQ;mCIHzs=*Z&CwejL}^ck@W0I>nc*(Nf4*XzY>KP{x|nU|nkF=K;9na$Yk zPOH8x7P+6S-*5*n*a^p+~P0F&tug+^kvKbM)#hdHPlCGiH+;wi#-Y-C+iMIgJaPW^DnmhHo_;5dVi#pZVKh>j;+Oh+VYwL4^kNp0all#l zQTEgU-v-$)ojL0dbVx+pf+<7(023sbv;wlbiaH`ZtlBge2aQV8j)n=h&wo+nw>-@; zSUzeP)56|5n4_E6Ya$gQvtjd&1p53E8RAIA$Fj;y1Ahc5%G<4RM0R<2pr6^@WX9o3 zUt*7Dvuf=g0h=$qNqsQ0*{{((lV4VCy}m$1M^C~6Qx4jCnQ};agDPPLyxlUBA}Z~g zeb>Q6GtF`%eVzKGsZ>q9eX1F{eNA0&Ws;oA_o#LfI<(p{$?2oB?Tu$S3PGdNyY19$r;>QX@$KESeDi6&Fhwo?PT(5kqQYmhj z&1e`+`nixgClpKz1veXRZFzS~=<-Cv54Zhb+Z6wMFHJT6>ERC!E62nSk1F-8N?WJ$ z%2{PqSGW*TjPHJ0->CILN^ZzL-uV83+Xo;xSe23{rFh@{6_w)+?{B`nd7@|1J5{2H z$EjrBM2AwfXR7Uv2OQaoPU6VQJp2>0Y1u3MsOh1NgIT@*YX97_;^}3@p}g5;m80ed z%hKNL|4RR_pTnhKe^dC1a4qY4{#)R33m=-y$psIb1#`~QyUx;3S;#w{IT85bB8!8p*x&bYf$ozWshBYuVlPTlesjR z=gvx{<>h+^Plxl*OdmWwb!_b9ds{+1vxPO|=O?m%=hCEYw)UlP!A{(p&Of7cb}Jpe z8KLJvcHUUlt^6DLp{DV``L-HgpnJCE)1=1NCGvmrxUze2T0 z!qGPN@6y%cif1p~ri{2ac{MU-O1$sLywdo{l5IW2KXRL`b&u>OYb*b$kZ0`!Fj20l zqp4*V{-TMGTs=C2f$CmXNZI`tD4$E>MD^DC{laHi9Do&coEm z{vE2EL5Rg!y*FQhx}yhg7a82MQuU-S?bFADg-C zGYKS65`fuq{Dk$zmSflREC&SesOlr3Z=eMovXscA0d7C40D){a&(rVFp4fst+vo2P z97`iUf0n1NX1@#Drr$qA9uqFz)6%6AOE>&R&4V($Ev(XyF|=SjB)s;<8$r{Vj$p~N z7QUwLjbQ1sDg>YmeFN6|h`mts_RDZtv$uH%MtpmTRb#*+{Rcc>`XRD7;3#FlA^Bc~ z2O`mLzwBc`au$q%+~*xePjv}lGZO1Z<%ON z(#z)3H_fJRdXQE;msWK*t!lh+Can&hh8dfu(>Fb~Qk(ytz6q6-^i7(};dgR(*^@r7 zJ9ZU1BKSy1h>s@eHGfLk;t2Qm=r(2V;7`s*#t`l!lgZiw1Z%O@Kje^Uh>GeZMpTWs z6Njj7B|=m{S5XH?&EAJRSxgGpfxsN101T0=W*lcepnEjerG+j_#H_MSa}5_vZKET3 zeAiPuYG|pQurf=!;w4rhaxo78cT{Z=yT4S6P7WS&5s?rZiO2X&5^;~swx6~%i*QX9WW zYlGk_T5xWmLKA19j*3{cIIf-0FiVN7x-rF%K8}P4H)_{iM7d^-jZcRvD6VXsP?xo* z>CbO7gK}E5Z`#|!Nf`fh^#ZfLC474$#U<af0Gl)gK__|QGfNK~ z=NKGI#4yCXteY#7nI|=aXpQ*NK9dM-NTiI?&?~9WqM)3w zGQB8?S(<>go?+i^$se~HdU`xweM5Ns5_x6C?}`13?THud>Dw5M{5~?6jxzFYt`12v z1#7S=nx}S$tM~nRu5t__kT-nbtdidq&gj0H#FX&b4jRk)cG7st#QCsmvr@8UM%a2k zclCJvxHMidUZCVOj5;2qEWatb}uNP=aOE5Rr7RzOk$^>7G#bX%dRj*Hh-1{K4j$ zJtpgiCdZzPeiY$p`AtgVl^E)d=GyW{_?zEu91`Z$zCEy@M0s0ivqU_-FAyu1U z^P0e^BnPXLBl!nG=P#po_0VF_^f@~F z9gI!xLPp-3nM(G`(1men;-#tGcLYWBD9%^zr(|C1fWX)|Q9D&P)d#s#ah`r?HD}pJ zg@;0P!EY`=&&sivXYx-g9UhVc+q>=w-HbdZUicsz0kCEiC!-*eVmRs9G%tp^pG76z zIDHqlyu|UFgSK70V7I~kF`ZO1TRQ1aFajejEYTQqD8|Tn))!rzVV|UFy6P8Onc+p- z{60NHkfC;p8)>au^-zdq_0X{t<0B zD2E+|Z#c6N`-a_R#a=SIElcmE7%#qHf57FwGP!x)22o87b!;kC{!(kuHL1Rq@#Q`aswy&4)_*n)A-FS7~3p@?feO0j#wHffpc znd(xq55hvH!1lOmqI}XeWmZxfqXlJ940S81dmdU%seAcRvjMZ+%n6ylQ5cfO>q5Qv z1kDpZ4yH+`2^1te-U&_s3*ms#0LP-3(ExJxFdySPn1B?4c$foV){2+|40V7AqyC?6 z-e?CNHpM(r^@Z*%hQTQb6nh0b2N_@A9NRxj9m~?G|1-G>LV7GE@)v`tPG~iW&d>Aq z#YrIFI|-ixZ&u7sq{ICg-P9mNrvt<~xfG*dlJ0M0@NYS_^5F<|W=> zGy=X#^dxJiMdud5Z`)TuWzW?1e81sp3ErnG!uzCrQh@bmpHxz|1{wC-X}TtTHAoq8a*Xp~husqLMWl#g`&D%w*>%bjIn{O?Dka7$@k5$^ z9tR;bCA0Kr)F2C)Of*u{OKU7s9oy4zSU1QIq}Ay1kHBGp$qmqlfbapQYRB-@#>Mve zi}dnGG?;%vc7^-Pn$6+NEw|gp`LFK_rC&dKyL~!y%TIcz29* zG7CdCrDD_M>ZztXyQj7($J&&aLB6__Q{765Pbu!1&Fn$71#HstHFL|i++DuqetO~9 zsShf`6^A~km^}9V+zIddB_C8wR~(uxI&|k{<LB@<)0q0)Oo`Dc$(xvZ_9 zJrcOe!~CaKo#R@8SO2x_MziIEn%u?|>(4CNjY8Vb^7C>1kzl1f#nD)l9FfhP31##D zh(4shpzJPXvy^>I+22vNxV-)|x=q?QsLr7-&c$PREyHE}rw#1~mHj9p7hplZ^k&iPz5?eek#mF$E zENi?=MIy7U0hdK(zgU;0Tnww~Z4kxvfO^v0tB)$E@`9+T;+p&}=E&>#bBt}?Iw&_j^Fu&XAUyO##|9(nnGq(^= zKQEn1Y9XXLFX_~C9sIMF!1L=hJikP(oe^q~1pYJ=4-2NTE$`B1<3ifz6d^nwfHhZe5_vLfMxn`zB?-MH$2QBn%s<0c{FRZEYd;RXa~9z{q)l z6qOLN87Z)7W6%Vi+tlO>$kZe{yG~}%uT#VISnjWNN&!tq{O{thmS%ZS{E;^9A?w$V8efLwcl-$bM zl*&2h`f2C-iJlqfc2-t9n^HUH+&b;t`jf_=9{j_DAH5ddc6`R!dOxQ~ac!8**?_jr z%sFTAw6pkT;8yV6;P~d>?^D*i6fW5bd)8SG`j+y5~WhdKqiS~D;Mi-47o4NG z>H(XfMdYU?FqO!~@R1I=(E315TIeKo5kMhj43iU9LhRHT&mASI1Adl?A|#k3d~&UM z9h^A~926ZdPm1w3YBC7~IH%p;E&T)DTebQw!1qy2if}2UyMKss19&rzXE(|sx*q9& z(tVn8>CchPQ}V1`M9hnvY>ph8WTtd&BH%fNpi(w;Pw+1k9Z8|VDBd5lar_HIk!evVqNBPAAcR6^baF=5 zsd=tPaV}W~IANy67@P#l>fr+~`HTji<67v9sJ%y%_7ek)Dn!n6>CUkXRv6T1aRYRv zpr+o27Ym)K)mT_v8z@6P9$|6WiFpbDqHc_bmgjCroR_>$gO$AHw^DATe7pO*um0An z6Kj5Q@yC}Z&)wOqw4GGyPK8&!9L_s^HD#2)whN%~X3EtRC1=azzNuY*ba3kYA04@~ zYIfVPdxE$S5@7*7E1Cej1LGb@;*WC92| zxndn4#2u%{0W1+VoR{F7Wt7E|7ggn5M?-0hvcIH^h%7Szk`;Y1WFmcrT7Vs*gBtyd zp%tQdvK1Mlbebfj!3l!Y&>3FYqdO`^^&6hEK4?6AjPBt$#(X$=?uJAz<@3mZQ?d({ zqMGpw6Vl{McXlf+5NKXe&ia&7JxW%ulG!&Z+%GD<)p4Wa`wj1J`QDa^;79vDJTSFY z*>E&m)uM=}!$oJ{cmtdx$8b#fSjl+Z_}TH*IBO6EuT7IH?g={ zkK3{ZM?_9!)tdZ7>JkJ-(gIE-_IzP*O%k&7l(PR# z83ikOhG6&iREM%V_>)&6V}jiilf%09QGwYy%#+j0amaWU>r0e>{)+w?rt~yUfqCGM3PJa$PnA8&tAnC;+-ccD# zEm7p9mr#77c3Nzfp5-;G3nM^`h@N94T@dMrw~izTY=&<*Y!~ev8$-}*#Xg}tGeuN~ zz)0uI5~8@M=@BYK*tjApM3eDICwbjOlu#!4j#}x=$5~l=7f+(l0I=;!mvN2A3aaI@ z7h$oIWp57xO2A)H6;2)%4>cV=dQu``Ub0~_5tG1&Ls4`<3So6LIY7{ZRjIrjM;@hL zp{HaR7eqS-^*>N9i^#y*XXakt@%D~ySIm_)OqVr;%Ql2FHv%_h7mfAIX0HtO&1Tn5 zB+X`T!Z9NI{hGS>Pk--pID6CW)8qVg-&?-1rr#L6eR`U1f6e~c-Rwg!Bodhg^cD%;4nFwQoVE7KP3o z@SpPy1q*6w0)GF1jN_8t?rI7~S52DKYAQK`rw5(vtR_yAOYr3l+G}bemo5@+(y^j3 z;YN=N)9eo%7}CgAWJ_9^l0Z6y4&!#DTF;~ub{Elue8Vs{${vIm(#GgvV^7uE(o>G2y0?|M=?8C znBcp{;MPyML7{M$a>5E3bgh?z(Qg zgQ^=sZohXxZX!QKf`O=jq6hs!NV`Z+aaOeowp#ivPq!a(3Roadq;Dplur*iLFI?p3 zX!d_FNAenESXvwv&D>El}8*oE1gRm$pZvpL%*NA3xG7fybZE@uG` z{Y%s3XVGLP%p|}USjISNEyjtRIQSmHm(1NIQTxOKN%WkWXo~}qB;&WvcpRBfu+d3R z{JA2Ao5=(@FNyYfI2ESI`3a}15}30P03oss7P;@#@5jwZ;xQzilN7y&_;-o*CoTg6 zpDI}i@iC?aF*z@&0-a&^9N)hySXutsYpw`}Wy&D;@CbsQNxt(VQ181*RpW*-)b++2 z(sJsf2wBk4gYz1FHQn&~>3bSE%js$nAtSI@nzDw8Giqw6xvQ*Pe_B~kaB0UnT)}cY z)TM6`SIv1>4f+dsyZVgvpE`*D$L1y#0C^`R(HI2Ek||?+)o!eYhS^D~#JO}9>gzBf zIZ0`#q_bIOFmBSnM~!%lzMXAx-5Q68a&R7*cj|+Am+0^2!Es?GXTrRWqe2H4?)%T% zmkEQFKg0m(aC^p^Lth!Xd1|hxcDkrGTvQicRzI;}cG;H6O|#1y*?ISfYf|ReiT4UZ z2WRtZmAZHv7dx<^tk@Jrh_F?&`MaiSX7eGL9-k3f@26+eSqr7GHk`h8B6~J{}j<4qdkXGe`~x12Yeq0`~KwG*p;Sp9=)L>@%0HmW2YHWAOX869*(E?7=yG7|{13owyA zwli>UF#+cia~9mnAF~|fx`CaSBebY!&80Jx3Gj)o_)Uw(Zf%0WXm#Y(dhyQ7xkG4I z3{R{hB_v~rNkyTCuw#cT8BnW9GU9Cdag}-Pb09uE?$2*XfVbQN}ty~kt z$6<)3F%O8CC6U1I5_bi$$93_Me1zAV5hT|X6yPF{P$06Kf-IY11wya^lY6boUx;Hd zlD8pzvG3Bbv_pM$AujO`4P5rXqB8_PDJE@tAV0>~4(7j(Aeg=Z&pF>^nF3l~*7c?_ zCe^)dz~2S-XNNobEJBQOK8F7ZUQ%%#{?Y4`rJ;iF%M*3Kec@i|`X9gk8Pn{4v9O45 zZIZH3n^>plv;h;7G%MLD`wZRataK9|gSgLdw^MD**dke&rZ$PO&Hj^es50l(F{*B|)uEUe^PlG=S{^a$r>+r4Pw~oI%uPj`27_kG7 zzx-bY?m5r=BALrBVId$RVIb@`>~nb)(|Hw2<@RtMh48R{V4vIBGQG1!Id(R@vuj4^ zCPb|TjWE>S63*K?+4|GdKRP|P{mAt8BXMOl?pRq3E6-@?~Q8Y6)F!5LukPD0l&_F5v zfc!j`@%j6Uo>GVxxM5XCeEt|(i;=0sKJA7h?3e&6l-b@piFy_hy%_A4C>aDJX|AoGdroJjgctce1pmchG#X(VVFM6vI4#q zROezJB0n)wqfru2Az9tC5U0LyCqzwT(w1xb4EtO5xir^wnoB9I52vj&p5Mhu*&79+ zz2m#Sb6_^#t*qTMBQye==}!6c?(Uxv4%|;a#yHt%6`a{sR%{68Z^X&o{FkP3W`zC5 z9@y=z;rwlrZL|4}Qy1<8rVy3s1SwX&@Rcvz?3*iIJ6*gsTwEVcT{qD*o4VDgX2}}s zd#`vrWj24qWC0z1Ryuu3?|DTIDw|%L5nlf|tIlwAaP0JW*6$Qd9GR`eiNQUOabi$A zbOo}?mYL{jb7e|GXEM?QYZNmdwImm1m6WZg>?O*G6-gYu*G#u5`$vLa$$D6WkQqykez6w?Af8mONBZi(1=L~4rCf_Mvm!rC@N z?KsK@KWP0i2{rc=HYPgmI5o>f%roeOS&X9`o$+d)xS%faHDR8yM9eb~jm|g5(-N3t zAjCw>F`yemQOYYiqUIP2%rQ<4!)?cC7(*Hd6c)T2W9M6O5oPC#@woJ7t0zUCeo`eO zxk0*Y<0DMIOB)m!MTyDBAwa^dL5Dap$c+5Hv=#;GhQ&Zz zv+wK~fDR)8*G~L5`ymC!wdWuC=7|vhzVEhgqUpB>C*PQMAHG%kZt1s9eD;`x?Jwq5 z@V{xV;5B7T^0sZO#S@43uC@nlcDk^uRtftF1PdY9aTNArJ$gW4*ph^kW|h$PnWGQBX9S%zkkN)-ehNq9%C<@Y6BAZkW!@T?4Xa1xuz! zM`EbarOFS_r%-kl@Q=-ey5c#etBmI6M|kfm+~0!fUiS8~o0sNF>ZVKT!X@j%X$=!? zvuT9o(;BBv&ZZrK@;p0#nx-(Ee~JGMfAVY`^<$cPKxcQ8m5~F*k5*EbIQpt&<05H}1Q` z&u%=Z9P-X?JgamK-rG17&hbxg9GbvE%j&t@8YQ;|-==f?qvo$UKD(RaXQsCgv(xvi zUBvYE$9Ow0Z$xhq9R;AAbQEp;ItZ%x&5=doYsHXJ6Bx0C8VX)7U4yeJOjlttmXIy$ zd7q&p4rBXDbKDLk)W>!x*)q5B(LK7HMD8U~6MsC)xJULU_BIbxRZg z)aRAD`k)M?Z3);XK$bQU(138jDd7t9G|{%_x<%owXTaOriyt0XC{b5YS0(7`pV{Wj z+5e+$6Dz+iUBCSHWkiCsXbb-1ZJJ#DZ^~Cgt_JB}hgQ;2WWX0I(O4T1(bZKwn(Iqa zt<5-E5iP_BcIpe?uRq? zYqu8)fP_aGas6FfEN%}4`O^6T)YDUpfyaFeaDIXo@AI`IOX@S9r^WpU=GP#c5rva= z4cBUV?wSarAN1GM_%3w~jCA{I2no5!ejgDA^g6)D+Am7YE3X;Uc#}xInt-===^DZ9 z(Xo`3izk|!_llm@y+>N+jVn>#_`$6*(!hL%`IC+i(EJIm7M`$!8En9dA2En{&h^3o zCXoUOD0b7L@WW(*#aq@8Tph>bz_05*adn6!wDkuFjZV?e$%+V%nB4s)SHSHEH7`nBEbH?7;WcH<`Bx(!`D>o%R;wBFmZVdKX74fVm?^4j@=>DiI~f$m_g zdyyOI-Tp3&cuQ@qcK|_&eOuN6VCo50C}OTe3QQv>qH4#B7`v}Y!J&gq8W&HQ? zXTx#-5Plj)2I#{a$uKF4c#A8^KhoRhfdw@I13+SUj5*KTcVlF%^nL4X>v+#^r%V=2 zS2SJU_4clBjC>{?K*gXLc2{PVP*e7vY87|kpkQ;;fqln=g=CP`2H*xeEqNp4ONI$H zm|h-N+0||jmew1RXbHk}@(DI)EWMpJfU zKNudY06kzwA5{0LfovSc0OxJqK5xnmJ8#AI{ttPTgnJ)?|k) z-*tQw!NIEy3ZOCHdxas-Z2o#>BV1-qM2S?@c263+Oe)P_#Jit<)iW?M4Dqhp7omVPXCVl>>%clk zjOi4Fei16NlEDHosR*11w@3PoMvaaT2|0@&%mR6p)g8}j(9lmjRJS)81Jz=@$Tu+*{-SG0k+C&a$Ce*1RR0#>$ka+w2-BK&M*WT|H zy6UFvRm%L7Ev{SJO}8l{jTCb}X1cZe*0f)ktZ?bYU~K6R*(Dv=Jb(k6W@|S*eUq&l zALZB(?(WkxlXb&G4w*J&>WqHlj#kLyfw)4TCH*zBVCsP(3S9*)vrFoi&$&U}39)H@ z$`#u2vu{$tw>ll=;fxKLuLHurGL!XKju>L|8F?Q&pGp#gayLxpl0)qbx9MXp`xiFOnRZS1^&NAL(rHI& z*s)^HQ8n$T8s9bRa4U5!vyPT40s> zeW9LlZ|Ka#%E?tzrIUqmN%EbW;%b(6OO(; zDcH*Q@z?US*kn&Q`u5~?-o)pGPy-)N?8$unwZ6HW)zdkvpK$o{BySbJGS&;eJP~;p zUom=VF4Z-i>UzTA%abOk1RD8ko8~ghr!&i+aP;lT0KbagFa{0G+Ub(DPdI#eDDs@e cIU1ZX=ij$DzkKA2N4|9Q7iP|){nY0F1@^Has{jB1 literal 0 HcmV?d00001 diff --git a/scripts/test_semgrep_triage.py b/scripts/test_semgrep_triage.py index 3e2420a..7d1d9bd 100644 --- a/scripts/test_semgrep_triage.py +++ b/scripts/test_semgrep_triage.py @@ -314,6 +314,14 @@ def test_allows_exact_tags_shas_and_same_repo_actions(self): ): self.assertFalse(self.flagged(uses), uses) + def test_inputs_reach_the_shell_through_env(self): + steps = yaml.safe_load(WORKFLOW.read_text())["jobs"]["scan"]["steps"] + step = next(s for s in steps if s.get("name") == "Run Semgrep") + self.assertNotIn("${{", self.script) + self.assertEqual(step["env"]["EXTRA_CONFIGS"], "${{ inputs.extra-configs }}") + self.assertIn("$EXTRA_CONFIGS \\\n", self.script) + self.assertIn('--baseline-commit "$BASELINE_COMMIT"', self.script) + def test_flags_floating_tags_and_branches(self): for uses in ("actions/checkout@v4", "actions/checkout@v4.4", "actions/checkout@main", "actions/setup-node@v4.4.0-beta.1"): self.assertTrue(self.flagged(uses), uses)