mirror of
https://github.com/garrytan/gbrain.git
synced 2026-07-28 14:59:47 +00:00
800108e014
* chore(ci): refresh GitHub Actions SHA pins (checkout v4, action-gh-release v2) Pre-ship pin staleness check per docs/RELEASING.md: both floating major tags moved upstream; pins updated to the current tag commits. * v0.42.65.0 chore(release): 92 verified fixes since v0.42.64.0 — changelog + version bump Aggregates everything merged to master since the v0.42.64.0 bump commit: community fixes, credited takeovers, batch re-lands, CI hardening, and maintainer-approved features. Net commit list excludes revert pairs. No new schema migrations. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(deps): clear OSV-flagged transitive dependencies via override floors Raise the existing security-floor overrides so the lockfile resolves patched versions of three transitive packages flagged by the OSV scan (@hono/node-server, fast-uri, body-parser). None are on gbrain's own runtime path (@hono/node-server is only referenced by the MCP SDK's optional hono transport, which gbrain does not load); the floors keep the dependency scan green. MCP/OAuth unit tests pass against the resolved versions. * chore(release): fold #3110 into the v0.42.65.0 entry (93 net changes) --------- Co-authored-by: Garry Tan <garrytan@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
37 lines
1.2 KiB
YAML
37 lines
1.2 KiB
YAML
name: Semgrep
|
|
|
|
# Static analysis (SAST) with Semgrep Community Edition (#2272). Tokenless:
|
|
# uses the public registry rulesets, needs zero secrets. Findings print in
|
|
# the job log; no code-scanning/SARIF upload by design (keeps permissions
|
|
# read-only, no security-events: write).
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [master]
|
|
schedule:
|
|
- cron: '30 7 * * 1' # weekly, Monday 07:30 UTC
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
semgrep:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
container:
|
|
image: semgrep/semgrep:1.170.0@sha256:c98f8829eea377274ee4b10656458b078b88232469b2ff913f091c2317347c9d
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
# Non-blocking initially (continue-on-error): the first runs establish a
|
|
# baseline without failing unrelated PRs. Graduation path: once the
|
|
# baseline findings are triaged (fixed or `# nosemgrep`'d), remove
|
|
# continue-on-error so new findings block PRs.
|
|
- name: Semgrep scan (report-only)
|
|
run: semgrep scan --config p/default --config p/typescript --error
|
|
continue-on-error: true
|