From 5b6023045e8536cd9eab08ea44fdf49ff8b420b4 Mon Sep 17 00:00:00 2001 From: Edwin van den Houdt Date: Thu, 23 Jul 2026 12:51:00 +0200 Subject: [PATCH] ci(semgrep): install with --ignore-installed (apt-managed PyJWT can't be uninstalled) The runner's semgrep install failed trying to replace Debian's apt-managed PyJWT ("Cannot uninstall PyJWT ... RECORD file not found"). --ignore-installed installs semgrep's deps fresh without uninstalling the apt copies, staying within the runner's constraints (no setup-python, no container job). Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ci.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9a79b49..136cba7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -115,14 +115,17 @@ jobs: # Installed via the runner's preinstalled python3/pip — NOT `setup-python` (its Python # download failed on this runner) and NOT a job `container:` (this act_runner times out # pulling the base runner image for container jobs). `--break-system-packages` survives - # PEP-668; pip drops `semgrep` on PATH. Verified locally: install + scan run clean. + # PEP-668; pip drops `semgrep` on PATH. `--ignore-installed` is required because some of + # semgrep's deps (e.g. PyJWT) are already present as apt-managed packages, which pip cannot + # uninstall ("RECORD file not found") — this flag installs fresh without uninstalling, so it + # never touches the Debian copies. Don't drop it. # ponytail: report-only for now (no `--error`, so the job stays green while the initial # findings are triaged); flip to `--error` to make it a blocking gate. See WP-30. runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@v4 - - run: python3 -m pip install --break-system-packages semgrep + - run: python3 -m pip install --break-system-packages --ignore-installed semgrep # p/default = curated cross-language security (covers JS/TS); p/csharp = the backend. # Anonymous registry fetch; --metrics=off disables telemetry (not `auto`, which uploads # project metadata).