bleedingdeacons / promises / 32869004291
88%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 28
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 88.097%. Remained the same
32869004291

push

github

web-flow 
chore(ci): add Semgrep gate, pin actions to SHAs, add Dependabot cooldown (#6)

Ported from amber, which piloted this. Closes this repo's
github-actions-mutable-action-tag and dependabot-missing-cooldown findings,
and stops Semgrep scanning depending on someone running it by hand.

Semgrep is a gate on pull requests and on main alike. `semgrep ci` is
diff-aware on a PR, so it fails only on findings that PR introduces - the same
bargain PHPStan's baseline strikes, with the platform holding the existing
state rather than a committed file. On main it scans in full, and release's
`needs: ci` means a blocking finding publishes nothing.

It is a run: step, not semgrep/semgrep-action. uses: steps ignore
defaults.run.working-directory, and these jobs check this repo out alongside
its siblings, so an action would scan all of them and file the siblings'
findings against this repo - where they would never dedupe against those
repos' own scans, and a merge into one of them could fail an unrelated PR
here. It also keeps a third-party action out of the security scanning, which
is the shape the trivy-action compromise took.

The step skips when SEMGREP_APP_TOKEN is absent rather than falling back to
the OSS ruleset, because some of this suite's findings come from pro rules and
a scan that silently checks less while reporting green is worse than no scan.

All action refs pinned to commit SHAs with the version in a trailing comment,
the form Dependabot maintains. Both Dependabot ecosystems get a 7-day cooldown.

1125 of 1277 relevant lines covered (88.1%)

5.35 hits per line

Jobs
ID Job ID Ran Files Coverage
1 32869004291.1 28
88.1
GitHub Action Run
Source Files on build 32869004291