fix(ci): prevents semgrep from failing on forks #3092
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the 📝 Walkthrough📝 Walkthrough📝 Walkthrough📝 WalkthroughWalkthroughThe pull request modifies the Semgrep workflow configuration within the GitHub Actions setup. The primary change is the adjustment of the conditional statement governing job execution, allowing the job to run under additional circumstances when the repository is 'zeta-chain/node'. The workflow structure remains unchanged, retaining its defined triggers and steps for executing Semgrep, generating JSON findings, converting them to SARIF format, and uploading the results. Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
jkan2
added
no-changelog
jkan2
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Outside diff range and nitpick comments (2)
.github/workflows/semgrep.yml (2)
Line range hint
20-39: Consider adding security measures for SEMGREP_APP_TOKEN.While the workflow uses a secret for the Semgrep token, additional security measures could be beneficial when dealing with forks.
Recommendations:
- Add conditions to protect sensitive operations:
env: SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN && github.repository == 'zeta-chain/node' }}
- Consider implementing repository-specific conditions for SARIF uploads to ensure security findings are only uploaded for the main repository.
🧰 Tools
🪛 yamllint
[error] 19-19: trailing spaces
(trailing-spaces)
[error] 22-22: trailing spaces
(trailing-spaces)
Add permissions configuration and fork handling for SARIF uploads
The workflow lacks necessary permissions configuration for SARIF uploads and fork handling controls. This could lead to failed security scans on forked repository PRs. Required changes:
- Add
permissionsconfiguration withsecurity-events: write- Add fork repository condition similar to other workflows:
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'zeta-chain/node'Example implementation:
permissions: security-events: write jobs: semgrep: # ... existing config ... if: (github.actor != 'dependabot[bot]' || github.repository == 'zeta-chain/node') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'zeta-chain/node')🔗 Analysis chain
Line range hint
31-39: Verify SARIF upload permissions in forked repositories.The SARIF upload step might require specific permissions or fail silently in forked repositories.
Let's verify the GitHub token permissions and potential issues:
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Check for similar workflows in the repository that handle forks rg -l 'github/codeql-action/upload-sarif' .github/workflows/ # Look for permission configurations rg -l 'permissions:.*write.*security-events' .github/workflows/Length of output: 156
Script:
#!/bin/bash # Check the complete workflow file content to analyze permissions and fork handling cat .github/workflows/semgrep.yml # Look for any conditional fork handling in workflows rg "if.*github.event.pull_request.head.repo.full_name" .github/workflows/Length of output: 1908
🧰 Tools
🪛 yamllint
[error] 19-19: trailing spaces
(trailing-spaces)
[error] 22-22: trailing spaces
(trailing-spaces)
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## develop #3092 +/- ##
========================================
Coverage 63.38% 63.38%
========================================
Files 422 422
Lines 29915 29915
========================================
Hits 18963 18963
Misses 10111 10111
Partials 841 841 |
Co-authored-by: Alex Gartner <[email protected]>
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Description
Similar to #3087 - prevents semgrep from error out on forks
How Has This Been Tested?
Summary by CodeRabbit