[SEC-6115] enabling code scanning via semgrep - #12
Conversation
russwyte
left a comment
russwyte
left a comment
There was a problem hiding this comment.
This PR is red, and it also does not actually enable GitHub Code Scanning.
Please:
-
Replace
.github/workflows/code-scanning.ymlwith the same ~50-line workflow that already landed elsewhere (for example scalafix-rules):semgrep scan --config .scala-security/scala/ --sarif-output=semgrep.sarif, thengithub/codeql-action/upload-sarif@v4. Delete the commented Claude/Bedrock triage job and the extra permissions that only exist for it (id-token,pull-requests,checks). -
CI
build (17)is failing, which fail-fast-cancelsbuild (8)andbuild (11).olafurpg/setup-scala@v10installs Amazon Corretto17.0.0.35.1, which NPEs on cgroup v2 (CgroupV2Subsystem.getInstance). That is pre-existing in.github/workflows/ci.yaml, but it keeps this PR red. Please bump that workflow to a current JDK/sbt setup (actions/checkout@v4,actions/setup-java,sbt/setup-sbt) so the matrix can pass.
Un-nest steps from strategy, replace olafurpg/setup-scala with setup-java and setup-sbt, and keep Temurin 17/21.
The 2.x runner needs 17+, so pin sbt-runner-version to 1.12.11 for the 11/17/21 matrix.
Keep 11 and 17 with the sbt 1.x runner.
2 participants
SEC-6115
Description