Repository navigation
ci: remove per-repo Semgrep scan (the Semgrep Code app covers PRs) - #25
Conversation
The semgrep-code-hyperpolymath GitHub App (Semgrep Managed Scans) already reports semgrep-cloud-platform/scan on every pull request here, so this workflow scanned the same code twice. No Semgrep context is required by any ruleset. actions.lock loses only the Semgrep-specific entries. The edited workflow is rewritten as KYAML with standards scripts/kyaml-format.sh (yq -p yaml -o kyaml), which refuses any rewrite that changes the parsed data. Owner ruling 2026-10-08: a workflow touched by a PR is converted in that PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013aSu89DNALjTYHBvA6FcoM
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (1)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (22)
|
| Layer / File(s) | Summary |
|---|---|
Workflow events and security checks .github/workflows/comprehensive-quality.yml |
Pushes to main and master and the daily schedule remain. The security job retains secret scanning and conditional dependency vulnerability checks, but removes the Semgrep SAST action. |
Source and specification checks .github/workflows/comprehensive-quality.yml |
The dependability, interoperability, validation, verification and functionality jobs retain their checks in the JSON-formatted workflow. |
Repository and build checks .github/workflows/comprehensive-quality.yml |
The attestation, performance, accessibility, licence and documentation jobs retain their checks in the JSON-formatted workflow. |
Priority: ⬇️ Low
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Merge Risk: 🔵 Low · up to a57d6
This change removes the repository's own Semgrep scan and relies on the Semgrep Code app for pull requests. Pull requests are still scanned. Pushes to main and the daily scheduled run no longer run Semgrep in this workflow unless Semgrep Cloud runs its own scans. The change can merge once the owner confirms that this reduced coverage on main is acceptable.
Security Architecture Review
Security architecture risk: 🔵 Low · up to a57d6
The change removes an advisory scan, not a demonstrated blocking security gate. Its impact is bounded to this repository’s scanning coverage, but the replacement service’s coverage of direct pushes and daily scans has not been established. No vulnerability has been verified.
Retained concerns
- Low · security · inferred: Removing the local Semgrep step eliminates its configured execution on pull requests, main/master pushes, and daily runs. If the external service does not independently cover the non-PR events, advisory SAST detection is reduced. Replacement coverage is unresolved, not a verified security failure.
Security review details
Security Blast Radius
- inferred — The supported potential exposure is reduced detection of security defects in this repository’s checked-out code, especially direct-push or recurring-scan coverage. The evidence does not establish expanded runtime privileges, cross-tenant exposure, or a production compromise.
Security Findings and Attack Paths
- observed — The security candidate is deferred because external settings and scan history are unavailable. No retained security finding or verified attack path is supplied; the uncertainty concerns replacement control effectiveness.
Trust Boundaries and Controls
- inferred — After removal, any equivalent Semgrep coverage must be provided outside this workflow. External repository enrollment, event coverage, rules scope, and successful execution determine equivalence. Check publication and required-check enforcement are separate controls, and the latter is not independently verified.
Hardening Proposals
- proposed — Confirm external repository enrollment, applicable branch and recurring-scan coverage, rules scope, and successful scans identifying the scanned revision. Assign explicit ownership for monitoring that coverage so future service configuration changes do not silently weaken detection.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title clearly and concisely describes the main change: removing the repository-level Semgrep scan because the Semgrep Code app covers pull requests. |
| Description check | ✅ Passed | The description directly explains the Semgrep scan removal, the duplicate coverage rationale, the CI scope, verification steps, and the remaining coverage limitation. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
- Commit to this branch
- Create a new PR
- Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the workflow lines,
With tidy syntax, clear designs.
It hops past scans that no longer run,
While other checks stay on the run.
Then nibbles clover in the sun.
Comment @coderabbitai help to get the list of available commands.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
## Summary Restores block-style formatting of `.github/workflows/comprehensive-quality.yml`. #25 removed this repo's duplicate Semgrep scan and, in the same PR, rewrote the file as KYAML. The KYAML form turned two gates red that read only block YAML: - **governance / Workflow security linter**: its duplicate-key check comes from standards@317101e0 (2026-09-14). Flow-document support landed later, in standards 13b872c1 (2026-10-01), so the old copy reads every step's `name:`/`run:` as a repeat of the previous one and reports phantom duplicates. - **lint-workflows** (this repo's `workflow-linter.yml`), where present: it checks for top-level permissions with `grep -q "^permissions:"`. KYAML indents that key inside `{`, so the check fails although the permissions are declared. The parsed workflow is unchanged, so behaviour does not change. KYAML conversion waits until both gates read it. Follow-up to #25. ## Type of change - [ ] 🐛 Bug fix: no code change; this clears CI reds the earlier reformat caused. - [ ] ✨ New feature: n/a - [ ] 💥 Breaking change: no - [ ] 🕳️ Soundness fix: n/a - [ ] 📖 Documentation: n/a - [x] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance: n/a - [x] 🔧 Build / CI / tooling ## 📌 New pins Head SHA: **`54cd2a4c52d193a33b6b1010a0c85f9a0c227761`**. No pins added or changed. ## How has this been verified? - `yq -o json 'sort_keys(..)'` on `main` @ `96b6620` and on this head: **identical data**. - The current standards duplicate-key checker passes this file. A planted duplicate in a KYAML copy is still caught (rc=1), so the KYAML file was clean and the old checker was wrong. - `grep -c '^permissions:'` = 1 (was 0 in the KYAML form). - `actionlint`: same diagnostics as the pre-#25 file. - No `uses:` ref changes, so `actions.lock` is unaffected. ## Checklist - [x] My commits are **signed** (verified `G`). - [x] I ran the project's own checks/tests locally and they pass: the checks above. This is formatting only. - [ ] New files carry the correct SPDX identifier: n/a, no new files. - [x] Docs are updated, and no public claim now overstates what the code does: nothing to update. - [x] I have not introduced a soundness hole. ## Notes for reviewers Formatting only. The data-identity check is the whole claim. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_013aSu89DNALjTYHBvA6FcoM Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
1 participant
Summary
Removes this repo's own Semgrep scan. The
semgrep-code-hyperpolymathGitHub App (Semgrep Managed Scans) already reportssemgrep-cloud-platform/scanon every pull request here, so PRs were scanned twice. No ruleset requires a Semgrep context in this repo (checked viarules/branches/main).No issue. This is owner-requested estate cleanup (duplicate Semgrep scanning).
Type of change
📌 New pins
Head SHA:
a57d69e33a154dbe53999d606e6a45dd80701028. No pins added or changed.returntocorp/semgrep-action@713efdd345f3035192eaa63f56867b88e63e4e5dHow has this been verified?
Files:
M .github/workflows/comprehensive-quality.yml
No
actions.lockin this repo.gh actions-lock --no-fix --json: findings diffed before/after. 0 new findings; only findings that belonged to the removed Semgrep entries disappeared.yq -e .parses every changed YAML file.standards/scripts/kyaml-format.sh(yq-p yaml -o kyaml), which refuses any rewrite that changes the parsed data;kyaml-format.sh --checkpasses. Owner ruling 2026-10-08: a workflow a PR touches is converted to KYAML in that PR. The diff is large because of the reformat; the only semantic change is the removed Semgrep step/job.actionlint: same diagnostic count as the original file (no new lint).Checklist
git commit -S, verifiedG).Notes for reviewers
Coverage change, stated rather than hidden: the removed workflow also ran on
pushandschedule. The app reports only on pull requests: nosemgrep-cloud-platform/scancheck exists onmainHEAD10fc902. Default-branch and scheduled full scans now depend on Semgrep Cloud's own schedule, which is not verified from GitHub.🤖 Generated with Claude Code
https://claude.ai/code/session_013aSu89DNALjTYHBvA6FcoM