From 9b2a878933498d84a06c4889806f3ec311cd9367 Mon Sep 17 00:00:00 2001 From: Edwin van den Houdt Date: Wed, 22 Jul 2026 10:10:57 +0200 Subject: [PATCH] ci(semgrep): install via runner python3/pip, drop container + setup-python MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The container: approach failed — this act_runner times out pulling its base runner image (docker.gitea.com/runner-images:ubuntu-latest, IPv6) for container jobs. And the earlier setup-python step failed downloading Python. Both avoided: run on the plain ubuntu-latest runner and install semgrep with the preinstalled python3/pip (`python3 -m pip install --break-system-packages semgrep`; --break-system-packages survives PEP-668, pip puts semgrep on PATH). Verified in a clean python:3.12 container that pip install lands `semgrep` on PATH and the scan runs. Still report-only; WP-30 tracks the flip to --error. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ci.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c368e84..9a79b49 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -112,17 +112,17 @@ jobs: # SAST for both sides — replaces CodeQL, which is GitHub-only (its analyze step uploads # SARIF to GitHub's code-scanning API) and can't run on this Gitea instance. Semgrep OSS # is a plain CLI: no account, no external platform API. Findings print in the job log. - # Runs in the official Semgrep image (semgrep preinstalled) — the setup-python + pip - # approach failed on this runner. Fully-qualified image name so short-name resolution - # works regardless of the container engine (Docker or podman). + # Installed via the runner's preinstalled python3/pip — NOT `setup-python` (its Python + # download failed on this runner) and NOT a job `container:` (this act_runner times out + # pulling the base runner image for container jobs). `--break-system-packages` survives + # PEP-668; pip drops `semgrep` on PATH. Verified locally: install + scan run clean. # ponytail: report-only for now (no `--error`, so the job stays green while the initial # findings are triaged); flip to `--error` to make it a blocking gate. See WP-30. runs-on: ubuntu-latest timeout-minutes: 15 - container: - image: docker.io/semgrep/semgrep steps: - uses: actions/checkout@v4 + - run: python3 -m pip install --break-system-packages semgrep # p/default = curated cross-language security (covers JS/TS); p/csharp = the backend. # Anonymous registry fetch; --metrics=off disables telemetry (not `auto`, which uploads # project metadata).