diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 793349be..7bee7df4 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -97,7 +97,6 @@ workflows: - 'dtolnay/rust-toolchain@master' - 'github/codeql-action@v4.37.8' - 'gitleaks/gitleaks-action@v3.0.0' - - 'returntocorp/semgrep-action@v1' - 'taiki-e/install-action@v2.86.7' - 'trufflesecurity/trufflehog@v3.97.1' '.github/workflows/tests.yml': @@ -310,11 +309,6 @@ dependencies: commit: 'sha1-c74f04c77a36247a813493945e803178b93d170f' owner_id: 6759885 repo_id: 1275650185 - 'returntocorp/semgrep-action@v1': - ref: 'v1' - commit: 'sha1-713efdd345f3035192eaa63f56867b88e63e4e5d' - owner_id: 147861678 - repo_id: 715166645 'ruby/setup-ruby@v1.321.0': ref: 'v1.321.0' commit: 'sha1-95ef2b042f9d7a56d8268cba8559e2842e2ad01b' diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index d331acbd..239c5ad8 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -103,37 +103,6 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # ============================================================================ - # SAST Scanning - # ============================================================================ - - semgrep: - name: Semgrep SAST - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - security-events: write - steps: - - name: Checkout repository - uses: actions/checkout@v7.0.1 - - - name: Run Semgrep - uses: returntocorp/semgrep-action@v1 - with: - config: >- - p/rust - p/elixir - p/security-audit - p/secrets - args: --sarif --output=semgrep.sarif - - - name: Upload SARIF results - uses: github/codeql-action/upload-sarif@v4.37.8 - if: always() - with: - sarif_file: semgrep.sarif - codeql: name: CodeQL Analysis runs-on: ubuntu-latest @@ -237,7 +206,6 @@ jobs: - rust-audit - rust-deny - secret-scan - - semgrep - codeql - sbom-rust if: always() @@ -251,7 +219,6 @@ jobs: ["rust-audit"]="${{ needs.rust-audit.result }}" ["rust-deny"]="${{ needs.rust-deny.result }}" ["secret-scan"]="${{ needs.secret-scan.result }}" - ["semgrep"]="${{ needs.semgrep.result }}" ["codeql"]="${{ needs.codeql.result }}" ["sbom-rust"]="${{ needs.sbom-rust.result }}" ) @@ -564,34 +531,6 @@ jobs: with: category: "/language:${{matrix.language}}" - audit_semgrep: - name: Semgrep SAST - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - security-events: write - steps: - - name: Checkout repository - uses: actions/checkout@v7.0.1 - - - name: Run Semgrep - uses: returntocorp/semgrep-action@v1 - with: - config: >- - p/rust - p/security-audit - p/secrets - p/dockerfile - p/supply-chain - args: --sarif --output=semgrep.sarif - - - name: Upload SARIF results - uses: github/codeql-action/upload-sarif@v4.37.8 - if: always() - with: - sarif_file: semgrep.sarif - # ============================================================================ # License Compliance # ============================================================================ @@ -716,7 +655,6 @@ jobs: - gitleaks - trufflehog - audit_codeql - - audit_semgrep - license-check - sbom-generation if: always() @@ -745,7 +683,6 @@ jobs: echo "| Gitleaks | $(status_icon '${{ needs.gitleaks.result }}') ${{ needs.gitleaks.result }} |" >> $GITHUB_STEP_SUMMARY echo "| TruffleHog | $(status_icon '${{ needs.trufflehog.result }}') ${{ needs.trufflehog.result }} |" >> $GITHUB_STEP_SUMMARY echo "| CodeQL | $(status_icon '${{ needs.audit_codeql.result }}') ${{ needs.audit_codeql.result }} |" >> $GITHUB_STEP_SUMMARY - echo "| Semgrep | $(status_icon '${{ needs.audit_semgrep.result }}') ${{ needs.audit_semgrep.result }} |" >> $GITHUB_STEP_SUMMARY echo "| License Check | $(status_icon '${{ needs.license-check.result }}') ${{ needs.license-check.result }} |" >> $GITHUB_STEP_SUMMARY echo "| SBOM Generation | $(status_icon '${{ needs.sbom-generation.result }}') ${{ needs.sbom-generation.result }} |" >> $GITHUB_STEP_SUMMARY