bleedingdeacons / rabbit / 32901279605
65%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 17
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 47.776%. Remained the same
32901279605

push

github

web-flow 
chore(ci): add scheduled Semgrep full scan of main, and a badge (#51) (#54)

Closes a gap the PR gate cannot cover.

`semgrep ci` only marks a finding "blocking" in a pull_request context. That
was measured rather than assumed: on sentinel #50 the same deliberately
vulnerable probe file scored "3 blocking" in a PR run and "0 blocking" in a
full scan of the same tree. So the Block remediation policy protects anything
arriving through a PR, and nothing else - a Critical/High finding reaching main
by a direct push, or one created by a rule newly added to the policy flagging
existing code, would never fail a build and never stop a release.

The new workflow runs a weekly full scan and gates on severity instead of the
blocking flag, that being the only signal available outside a PR. It cannot
block a merge that has already happened; what it does is fail loudly and turn
the README badge red.

Two details worth recording. It matches both severity vocabularies - Semgrep
returns the older ERROR/WARNING/INFO and the newer CRITICAL/HIGH/MEDIUM/LOW in
the same scan, so matching only ERROR would silently miss everything labelled
CRITICAL. And it uploads (no --dry-run), so the platform's view of main stays
current and UI triage keeps applying.

Baseline verified clean before rollout: amber, sentinel, confur and reach all
report zero findings on current main, so this does not start red.

247 of 517 relevant lines covered (47.78%)

2.38 hits per line

Jobs
ID Job ID Ran Files Coverage
1 32901279605.1 17
47.78
GitHub Action Run
Source Files on build 32901279605