ehoandClaude Opus 4.8
9b2a878933
The container: approach failed — this act_runner times out pulling its base runner image (docker.gitea.com/runner-images:ubuntu-latest, IPv6) for container jobs. And the earlier setup-python step failed downloading Python. Both avoided: run on the plain ubuntu-latest runner and install semgrep with the preinstalled python3/pip (`python3 -m pip install --break-system-packages semgrep`; --break-system-packages survives PEP-668, pip puts semgrep on PATH). Verified in a clean python:3.12 container that pip install lands `semgrep` on PATH and the scan runs. Still report-only; WP-30 tracks the flip to --error. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>