2 Commits

Include renames

Author	SHA1	Message	Date
ehoandClaude Opus 4.8	c404995980	ci: replace CodeQL with Semgrep (Gitea-compatible SAST) ... CodeQL is GitHub-only — its analyze step uploads SARIF to GitHub's code-scanning API and assumes a GitHub Security tab; this CI runs on Gitea only, so the job could never go green (it had been red since it was added). Replace it with Semgrep OSS, a plain CLI SAST with no account/platform API, which runs fine on Gitea. - Remove the codeql job (+ its security-events permission) and the schedule trigger (it existed only for codeql; semgrep runs on push + PR). - Add a semgrep job: setup-python + `pip install semgrep` + `semgrep scan --config p/default --config p/csharp --metrics=off`. pip-on-runner (not container:) mirrors the other jobs' model; anonymous registry, telemetry off. - Report-only for now (no --error → job stays green): a local dry-run found 27 findings, mostly CI/config policy (unpinned actions, .npmrc), not app-code vulns. WP-30 tracks triaging them + flipping to --error (a blocking gate). Verified locally: `semgrep scan` runs clean (exit 0 without --error, 306 rules / 450 files). CI behaviour confirmable only on the Gitea runner — watch the run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-22 09:34:13 +02:00
ehoandClaude Opus 4.8	7d3a63a7a5	docs(backlog): WP-30 — CI performance follow-ups ... Capture the deferred CI options from the speed pass (708d4c2) so they aren't lost: node_modules cache to skip npm ci, smaller CI runner image (act_runner label→image, needs admin; or repo-only container: for node-only jobs), path-filtered jobs, a fast split lint job, and an optional lean prod backend image. Notes the constraints (CI not observable from the agent env; compose images aren't used by CI). Added the README row. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-21 20:32:18 +02:00