CI: real-tool smoke for semgrep and njsscan

.claude/skills/deep-code-review/scripts/provision_tools.sh

@@ -55,7 +55,7 @@ bandit pipx bandit==1.9.4
 scorecard brew scorecard
 gosec brew gosec
 grype brew grype
-checkov pipx checkov==3.4.0
+checkov pipx checkov==3.4.5
 hadolint brew hadolint
 ruff pipx ruff
 syft brew syft

.claude/skills/deep-code-review/scripts/review_checks.sh

@@ -1018,7 +1018,7 @@ hubcmd() {
     solhint) printf '{"extends":"solhint:recommended"}\n' >"$td/solhint.json"; cmd=(solhint --config "$td/solhint.json" -f sarif --noPoster --disc "$1"); okrc="1" ;; # exit codes are not documented on the README: a non-zero exit with no row is never clean (guard below)
     ansible-lint) cmd=(ansible-lint --offline --nocolor -q -f sarif "$@"); okrc="1 2" ;; # exit codes are not documented: a non-zero exit with no row is never clean (guard below)
     devskim) cmd=(devskim analyze --source-code "$@" --file-format sarif) ;;
-    njsscan) cmd=(njsscan --json "$@"); okrc="1" ;; # JSON to stdout without -o; exit 1 = an ERROR rule matched or errors (-w would add WARNING; not used)
+    njsscan) cmd=(env HOME="$sgh" XDG_CACHE_HOME="$sgh" SEMGREP_USER_HOME="$sgh" SEMGREP_SEND_METRICS=off njsscan --json "$@"); okrc="1" ;; # njsscan drives semgrep: same sandboxed HOME and no metrics as the semgrep call; JSON to stdout without -o; exit 1 = an ERROR rule matched or errors (-w would add WARNING; not used)
     bundler-audit) cmd=(bundle-audit check "${1%/*}" --gemfile-lock "${1##*/}" --format json); okrc="1" ;; # exit 1 = vulnerable (cli.rb `exit(1) if report.vulnerable?`) but also every error: a crash prints no JSON, so sjson makes it not-run
     cfn-lint) cmd=(cfn-lint --format json -- "$@"); okrc="2 4 6 8 10 12 14" ;; # exit = bitwise OR of 2 error, 4 warning, 8 informational (documented); anything else is a crash
     rubocop) cmd=(rubocop --force-default-config --fail-level fatal --format json --cache false -- "$@") ;; # all cops run (a --only Security run would hide Lint/Syntax); sjson keeps Security/* rows and turns an error or fatal offense into not-run; exit 0 clean, 1 offenses at or above --fail-level (only fatal here, so 1 is never a valid run), 2 abnormal end (CLI reference); --force-default-config, --fail-level fatal, --cache false and explicit files bypassing AllCops Exclude are unverified: an unsupported flag exits 2 (not run) and the inspected-count check below makes any skipped file not-run

.github/workflows/ci.yml

@@ -515,8 +515,8 @@ jobs:
       - name: Allowlist guard
         run: REQUIRE_GITLEAKS=1 bash scripts/test_gitleaks_allowlist.sh
 
-  # The review_checks.sh stub tests never run a real scanner. This job installs the real tfsec, ansible-lint, rubocop, cfn-lint, pmd, solhint, hadolint, bandit, ruff, actionlint, zizmor, gosec, staticcheck, kube-linter, flawfinder, detect-secrets, gitleaks, trufflehog, checkov and kube-score
-  # (pinned, hash-locked where the ecosystem allows; no advisory-DB download) and checks each is RAN with its rule id on one canary. bundler-audit, kubescape and retire need a downloaded DB, so they stay stub-only.
+  # The review_checks.sh stub tests never run a real scanner. This job installs the real tfsec, ansible-lint, rubocop, cfn-lint, pmd, solhint, hadolint, bandit, ruff, actionlint, zizmor, gosec, staticcheck, kube-linter, flawfinder, detect-secrets, gitleaks, trufflehog, checkov, kube-score, semgrep and njsscan
+  # (pinned, hash-locked where the ecosystem allows; no advisory-DB download) and checks each is RAN with its rule id on one canary. trivy, bundler-audit, kubescape and retire need a downloaded DB or rule set, and cppcheck has no pinned, hash-verifiable binary, so they stay stub-only.
   real-hub:
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -553,6 +553,14 @@ jobs:
           mkdir -p "$RUNNER_TEMP/bin"
           ln -s "$RUNNER_TEMP/venv-checkov/bin/checkov" "$RUNNER_TEMP/bin/checkov"
           echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - name: Install semgrep and njsscan (hash-locked, own venv so their older click, jsonschema and wcmatch pins stay off the other tools)
+        run: |
+          set -euo pipefail
+          python3 -m venv "$RUNNER_TEMP/venv-semgrep"
+          "$RUNNER_TEMP/venv-semgrep/bin/pip" install --quiet --require-hashes --only-binary=:all: -r scripts/real-hub-requirements-semgrep.txt
+          mkdir -p "$RUNNER_TEMP/bin"
+          for t in semgrep pysemgrep njsscan; do ln -s "$RUNNER_TEMP/venv-semgrep/bin/$t" "$RUNNER_TEMP/bin/$t"; done
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
       - name: Install rubocop 1.69.2 (pinned, private GEM_HOME)
         run: |
           set -euo pipefail

changelog.d/hub-real-smoke-5.md

@@ -0,0 +1,5 @@
+### Changed
+- The real-hub CI job now also runs real semgrep 1.182.1 (the provision_tools.sh pin) (repo rules, no registry pack) and njsscan 0.4.2 through `review_checks.sh`, each on a fictional canary file; the job fails unless the tool ran and reported its expected rule on that file with no not-run or NOT CHECKED line. Both install from their own hash-locked `scripts/real-hub-requirements-semgrep.txt` venv, because semgrep pins click 8.4.2, jsonschema 4.25.1 and wcmatch 8.5.2, older than the versions the other tools resolve to. Not added: trivy (the hub reports its vuln scan NOT CHECKED without a downloaded DB, which has no pinnable hash) and cppcheck (no upstream Linux binary or checksum file).
+- The trufflehog canary assertion now matches the exact detector name `Github` instead of the prefix `^Github`.
+- `provision_tools.sh` pins checkov 3.4.5 (was 3.4.0), matching the real-hub job.
+- `review_checks.sh` now runs njsscan with the same sandboxed `HOME`, cache dirs and `SEMGREP_SEND_METRICS=off` as its semgrep call (njsscan drives semgrep, which otherwise writes under the real home and may send metrics); the hub stub test asserts it.