Repository navigation
test: planted findings for the security workflows (do not merge) - #96
Closed
bryanfawcett wants to merge 3 commits into
Closed
bryanfawcett wants to merge 3 commits into
bryanfawcett wants to merge 3 commits into
Conversation
Two workflows for the enterprise rulesets in #94, each run on every pull request into the default branch and staging: - dependency-review.yml: actions/dependency-review-action (fails on new high or critical advisories) plus npm, pnpm, cargo and pip-audit runs on the lockfiles a change touches. Passes when nothing changed. - reusable-semgrep.yml: the open-source Semgrep CLI (image pinned by digest, no token, metrics off), community packs for TypeScript, JavaScript, React, Python, Rust, secrets and the OWASP Top 10, diff-aware against the base commit, with Astro frontmatter and scripts extracted so the TypeScript rules read them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq Signed-off-by: Bryan Fawcett <bryan@nyuchi.com>
Review findings on #95: - run npm, pnpm and cargo audit on copies of the lockfile in an empty directory, with the registry on the command line, so a pull request's .npmrc, .pnpmfile.cjs or .cargo/audit.toml can neither run code nor silence the audit; - resolve ranged requirements files with uv pip compile --no-build, fall back to the exact pins, and warn rather than fail when nothing can be pinned; drop git and URL references before pip-audit; - scan Astro extracts in a scratch git repo holding the base and head versions, with Semgrep's baseline, so only new findings count; - show Semgrep's scan summary in the log. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq Signed-off-by: Bryan Fawcett <bryan@nyuchi.com>
Signed-off-by: Bryan Fawcett <bryan@nyuchi.com>
bryanfawcett
force-pushed
the
claude/sec94-selftest-tmp
branch
from
October 7, 2026 13:15
3e52ce4 to
dce7bcc
Compare
Member
Author
|
Runtime test for #95 done (all three checks failed on the planted findings, as intended). Closing without merging. |
This was referenced Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Runtime test for #95: planted Semgrep findings (TS + Astro frontmatter) and a vulnerable lodash lockfile. Both checks must FAIL here. Closed without merging.
🤖 Generated with Claude Code