From f7c2745027dde622c26a9c6ebeeeaa7718d32731 Mon Sep 17 00:00:00 2001
From: ulziibay-kernel <253135130+ulziibay-kernel@users.noreply.github.com>
Date: Fri, 9 Oct 2026 23:17:53 +0000
Subject: [PATCH] Pull semgrep container from Google's Docker Hub mirror

The credentials block from #23 breaks callers without DOCKERHUB_USERNAME /
DOCKERHUB_TOKEN: empty values in container credentials make the runner fail
template validation with "Unexpected value ''", so every consumer's scan job
dies before it starts. The mirror needs no credentials and sidesteps the shared
anonymous Docker Hub pull rate limit that motivated #23.

Add a self-test workflow that runs the scan on PRs touching semgrep.yml.
---
 .github/workflows/semgrep-self-test.yml | 13 +++++++++++++
 .github/workflows/semgrep.yml           | 15 +++++++--------
 2 files changed, 20 insertions(+), 8 deletions(-)
 create mode 100644 .github/workflows/semgrep-self-test.yml

diff --git a/.github/workflows/semgrep-self-test.yml b/.github/workflows/semgrep-self-test.yml
new file mode 100644
index 0000000..b964764
--- /dev/null
+++ b/.github/workflows/semgrep-self-test.yml
@@ -0,0 +1,13 @@
+name: Semgrep Self-Test
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/semgrep.yml'
+      - '.github/workflows/semgrep-self-test.yml'
+  workflow_dispatch:
+
+jobs:
+  scan:
+    uses: ./.github/workflows/semgrep.yml
+    secrets: inherit
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index d83ae14..3ce93b6 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -19,14 +19,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     container:
-      image: semgrep/semgrep
-      # Anonymous Docker Hub pulls share the caller's runner IP rate limit and
-      # have been failing this job at Initialize containers in multiple repos.
-      # In a reusable workflow these resolve from the caller's repo (with
-      # secrets: inherit); when unset the runner falls back to an anonymous pull.
-      credentials:
-        username: ${{ vars.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
+      # Pull through Google's unauthenticated Docker Hub mirror. Anonymous
+      # Docker Hub pulls share the caller's runner IP rate limit and fail at
+      # Initialize containers. Do not add a credentials block: callers that
+      # don't define the referenced vars/secrets resolve to an empty value,
+      # which makes the runner reject the whole template ("Unexpected value
+      # ''", actions/runner#4204) for every consumer of this workflow.
+      image: mirror.gcr.io/semgrep/semgrep
     outputs:
       findings_count: ${{ steps.count.outputs.findings_count }}
     steps: