ci: Enable Semgrep and Zizmor scans#622
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
Pull request overview
Adds repository security automation by introducing two new GitHub Actions workflows to run static analysis/security scans (Semgrep and Zizmor) on pushes/PRs to main, with hardened runner setup and artifact/report handling.
Changes:
- Add a Semgrep scanning workflow triggered on
push/pull_request/manual runs. - Add a Zizmor scanning workflow that generates SARIF, uploads to GitHub code scanning, and uploads the SARIF as an artifact.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| .github/workflows/semgrep.yml | New workflow to run Semgrep scans on main pushes/PRs using a pinned Semgrep container image and hardened runner. |
| .github/workflows/zizmor.yml | New workflow to run Zizmor, generate SARIF, upload to code scanning, and publish the SARIF as an artifact. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
adimoft
force-pushed
the
enable_semgrep_zizmor
branch
from
8feeea2 to
c468451
Compare
| @@ -0,0 +1,38 @@ | |||
| # SPDX-FileCopyrightText: (C) 2026 Intel Corporation | |||
| # SPDX-License-Identifier: Apache-2.0 | |||
| --- | |||
There was a problem hiding this comment.
Need to align this workflow with the guidelines mentioned here: https://wiki.ith.intel.com/pages/releaseview.action?pageId=4314885785#SASTStaticApplicationSecurityTesting-RequiredConfigurationParameters
This pull request adds two new GitHub Actions workflows to automate static code analysis and security scanning for the repository. These workflows introduce Semgrep and Zizmor scans on each push and pull request to the main branch, enhancing the project's security and code quality checks.
Jira: https://jira.devtools.intel.com/browse/NEXUIE-132281
Security and Code Quality Automation:
.github/workflows/semgrep.ymlto run Semgrep scans on pushes and pull requests to the main branch, using a containerized Semgrep image and a hardened runner setup..github/workflows/zizmor.ymlto run Zizmor scans, generate SARIF reports, upload results to GitHub Security, and store artifacts for further review, also using a hardened runner and a specific version of the Zizmor tool.