Repository navigation
CI: real-tool smoke for semgrep and njsscan - #2366
Merged
Merged
Conversation
Adds real semgrep 1.157.0 (repo rules, no registry pack) and njsscan 0.4.2 canaries to the real-hub job. They install from their own hash-locked scripts/real-hub-requirements-semgrep.txt venv because semgrep pins click 8.1.8, jsonschema 4.25.1 and wcmatch 8.5.2, older than the versions the other tools resolve to. The trufflehog canary matches the exact detector name Github. provision_tools.sh pins checkov 3.4.5. review_checks.sh runs njsscan with the sandboxed HOME and no semgrep metrics, asserted by the hub stub test. Tests: 21/21 (hub secrets-node stub test; k8s-js and js-iac-license hub tests pass; real-hub canaries run in CI) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The real-hub semgrep and njsscan venv now resolves semgrep 1.182.1, the version provision_tools.sh installs for users (njsscan 0.4.2 is compatible). Its Linux wheels are manylinux_2_34, so the lock is re-derived for that platform. test-provision-tools.sh now expects the checkov==3.4.5 pin. Tests: 61/61 (test-provision-tools.sh) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds real semgrep 1.182.1 (the version provision_tools.sh installs) (local rules, no registry fetch) and njsscan 0.4.2 canaries to the real-hub CI job, installed from their own hash-locked requirements file into a separate venv (like checkov), so their older click, jsonschema and wcmatch pins never replace the main env's. njsscan now runs with semgrep metrics off and a sandboxed HOME. Also pins the trufflehog canary to its exact detector name and aligns the checkov pin in provision_tools.sh with CI (3.4.5).
Deferred: trivy config (needs a downloaded DB that cannot be hash-pinned yet) and cppcheck (no upstream Linux binary with a checksum file).
Tests: semgrep and njsscan canaries pass locally; bash -n, actionlint, the size gate, the size ratchet and the privacy gate pass. The Linux hashed install is proven in CI.
🤖 Generated with Claude Code