From 0244db12651041e1840a8dfc564f667ecd9e6c1e Mon Sep 17 00:00:00 2001 From: goetchstone Date: Tue, 21 Jul 2026 07:39:42 -0400 Subject: [PATCH] ci: exclude Semgrep CI-hygiene rules from gate Semgrep added github-actions-mutable-action-tag + dependabot-missing- cooldown to the ruleset; the whole-repo main scan fails on 17 CI-config nags (no app-security findings). Exclude both, documented. --- .github/workflows/semgrep.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 5491cb9..b214c1e 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -36,6 +36,12 @@ jobs: - name: Run Semgrep run: | + # Excluded rules are CI-config best-practices, not application security, + # and they fail the whole-repo main scan on accepted tradeoffs (PR diff + # scans don't hit them). Same posture as the npm-audit allowlist. + # - mutable-action-tag: we use `@vN` action tags, not SHA pins + # (Dependabot keeps them current); revisit if we adopt SHA pinning. + # - dependabot-missing-cooldown: no cooldown configured by choice. semgrep ci \ --config p/javascript \ --config p/typescript \ @@ -43,6 +49,8 @@ jobs: --config p/react \ --config p/owasp-top-ten \ --config p/secrets \ + --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag \ + --exclude-rule package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown \ --sarif \ --output=semgrep.sarif env: