fix(semgrep): make the pinned image digest authoritative - #941
fix(semgrep): make the pinned image digest authoritative#941seonghobae wants to merge 5 commits into
Conversation
|
Warning Review limit reached
Next review available in: 102 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughSemgrep 워크플로가 이미지 참조를 고정 SHA256 digest로 관리한다. 실행 전에 digest 형식과 Docker 매니페스트 존재 여부를 검증한다. 검증된 이미지 참조를 Semgrep 실행 단계에서 사용한다. ChangesSemgrep 이미지 검증
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Current-head verification record (2026-08-12):
At observation time, SAST Semgrep, Scorecard, Secret Scan, OSV-Scanner PR, Python Security, and SBOM Generation were running; Security Scan and CodeQL PR were queued; CodeRabbit was pending. No review or unresolved thread exists yet. Merge remains blocked until all exact-head required checks complete and qualifying independent approval is present. |
|
Current-head verification record (2026-08-12 UTC):
The earlier local partial-digest manifest failure is therefore addressed at the central source of truth. Merge remains pending current independent review and repository policy approval; no stale or synthetic approval is being used. |
|
@opencode-agent review Review exact current head |
|
@coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='432497975d8e74822f853e095764ec5bcbcf29c3'
base_expected='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== checked-out HEAD =='
git rev-parse HEAD
printf '%s\n' '== requested commits available =='
git cat-file -e "${head_expected}^{commit}"
git cat-file -e "${base_expected}^{commit}"
printf '%s\n' '== changed paths: requested base..head =='
git diff --name-status "$base_expected" "$head_expected"
printf '%s\n' '== workflow outline =='
ast-grep outline .github/workflows/sast-semgrep.yml --items all
printf '%s\n' '== exact workflow diff =='
git diff --no-ext-diff --unified=80 "$base_expected" "$head_expected" -- .github/workflows/sast-semgrep.yml
printf '%s\n' '== current workflow source, numbered =='
cat -n .github/workflows/sast-semgrep.yml
printf '%s\n' '== SEMGREP_IMAGE and image invocation references =='
rg -n -C 4 'SEMGREP_IMAGE|semgrep/semgrep|docker\s+run|--config=|--severity=|--exclude=|--sarif|--error|--metrics=off' \
.github/workflows/sast-semgrep.ymlLength of output: 18513 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr_number='941'
head_expected='432497975d8e74822f853e095764ec5bcbcf29c3'
base_expected='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== PR refs =='
gh api "repos/${repo}/pulls/${pr_number}" \
--jq '{head_sha: .head.sha, base_sha: .base.sha, state: .state, draft: .draft}'
printf '%s\n' '== check runs attached to the requested head =='
gh api --paginate "repos/${repo}/commits/${head_expected}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, details_url, app: .app.slug}'
printf '%s\n' '== commit statuses attached to the requested head =='
gh api --paginate "repos/${repo}/commits/${head_expected}/status?per_page=100" \
--jq '.statuses[] | {context, state, target_url, creator: .creator.login}'
printf '%s\n' '== PR reviews =='
gh api --paginate "repos/${repo}/pulls/${pr_number}/reviews?per_page=100" \
--jq '.[] | {user: .user.login, state, commit_id, submitted_at}'
printf '%s\n' '== unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { author { login } body } } }
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 10858
I reviewed only head
I used the repository guidance that only results attached to the exact current head count as check evidence. Some attached checks are 🧠 Learnings used
|
|
@opencode-agent review Review exact current head |
|
Exact-current-head review request for The bounded one-file repair keeps the Semgrep OSS 1.169.0 image digest unchanged and makes one job-level Review this unchanged head read-only. Do not update the branch, synthesize author approval, merge, release, or weaken protection. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr_number='941'
head_expected='432497975d8e74822f853e095764ec5bcbcf29c3'
base_expected='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
workflow='.github/workflows/sast-semgrep.yml'
printf '%s\n' '== local refs and changed paths =='
test "$(git rev-parse HEAD)" = "$head_expected"
git cat-file -e "${base_expected}^{commit}"
git diff --name-status "$base_expected" "$head_expected"
printf '%s\n' '== exact workflow diff =='
git diff --no-ext-diff --unified=100 "$base_expected" "$head_expected" -- "$workflow"
printf '%s\n' '== workflow outline =='
ast-grep outline "$workflow" --items all
printf '%s\n' '== image references and scan controls =='
rg -n -C 5 'SEMGREP_IMAGE|semgrep/semgrep|docker\s+run|--config=|--severity=|--exclude=|--sarif|--error|--metrics=off|permissions:|SEMGREP_APP_TOKEN' "$workflow"
printf '%s\n' '== pull request refs =='
gh api "repos/${repo}/pulls/${pr_number}" \
--jq '{head_sha: .head.sha, base_sha: .base.sha, state: .state, draft: .draft}'
printf '%s\n' '== check runs on requested head =='
gh api --paginate "repos/${repo}/commits/${head_expected}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, app: .app.slug}'
printf '%s\n' '== commit statuses on requested head =='
gh api --paginate "repos/${repo}/commits/${head_expected}/status?per_page=100" \
--jq '.statuses[] | {context, state, creator: .creator.login}'
printf '%s\n' '== reviews =='
gh api --paginate "repos/${repo}/pulls/${pr_number}/reviews?per_page=100" \
--jq '.[] | {user: .user.login, state, commit_id, submitted_at}'
printf '%s\n' '== unresolved threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='.github' -F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { author { login } body } } }
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 16946
I reviewed only head
GitHub returned no submitted reviews. Therefore, no independent approval is present in the retrieved review data. This review does not grant merge authority. 🧠 Learnings usedYou are interacting with an AI system. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr_number='941'
head='432497975d8e74822f853e095764ec5bcbcf29c3'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Local commit and changed-path verification =='
printf 'checked_out_head='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git diff --name-status "$base" "$head"
echo '== Workflow diff =='
git diff --no-ext-diff --unified=100 "$base" "$head" -- .github/workflows/sast-semgrep.yml
echo '== Relevant workflow lines at requested head =='
git show "${head}:.github/workflows/sast-semgrep.yml" |
nl -ba |
grep -E -C 5 'SEMGREP_IMAGE|semgrep/semgrep|docker run|--config=|--severity=|--exclude=|--sarif|--error|--metrics=off|permissions:|contents:|security-events:|SEMGREP_APP_TOKEN'
echo '== Pull request refs =='
gh api "repos/${repo}/pulls/${pr_number}" \
--jq '{head: .head.sha, base: .base.sha, state, draft}'
echo '== Check runs for requested head =='
gh api --paginate "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, app: .app.slug}'
echo '== Commit statuses for requested head =='
gh api --paginate "repos/${repo}/commits/${head}/status?per_page=100" \
--jq '.statuses[] | {context, state, creator: .creator.login}'
echo '== Reviews =='
gh api --paginate "repos/${repo}/pulls/${pr_number}/reviews?per_page=100" \
--jq '.[] | {user: .user.login, state, commit_id, submitted_at}'
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 10166 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr_number='941'
head='432497975d8e74822f853e095764ec5bcbcf29c3'
echo '== Relevant workflow lines at requested head =='
git show "${head}:.github/workflows/sast-semgrep.yml" |
cat -n |
grep -E -C 5 'SEMGREP_IMAGE|semgrep/semgrep|docker run|--config=|--severity=|--exclude=|--sarif|--error|--metrics=off|permissions:|contents:|security-events:|SEMGREP_APP_TOKEN'
echo '== Pull request refs =='
gh api "repos/${repo}/pulls/${pr_number}" \
--jq '{head: .head.sha, base: .base.sha, state, draft}'
echo '== Check runs for requested head =='
gh api --paginate "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, app: .app.slug}'
echo '== Commit statuses for requested head =='
gh api --paginate "repos/${repo}/commits/${head}/status?per_page=100" \
--jq '.statuses[] | {context, state, creator: .creator.login}'
echo '== Reviews =='
gh api --paginate "repos/${repo}/pulls/${pr_number}/reviews?per_page=100" \
--jq '.[] | {user: .user.login, state, commit_id, submitted_at}'
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 9034
I reviewed only
GitHub returned no pull-request reviews. Therefore, this review does not establish an independent approval or merge authorization. I used the repository guidance that only successful checks on the exact current head count as merge evidence. 🧠 Learnings usedYou are interacting with an AI system. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current-head source review for 432497975d8e74822f853e095764ec5bcbcf29c3 against protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
The complete one-file diff moves the already-pinned immutable Semgrep manifest reference into one job-level SEMGREP_IMAGE value and uses that exact value for both log evidence and docker run. The digest, scanner version, configuration, severities, exclusions, SARIF handling, metrics policy, permissions, credentials, and fail-closed --error behavior are unchanged. All eight directly triggered exact-head security and supply-chain workflows, including the modified SAST Semgrep workflow itself, are terminal-success and no inline thread exists.
A qualifying independent reviewer must submit formal approval on this unchanged head. Do not update the branch, change the image digest, weaken scanner arguments, synthesize author approval, or bypass protection.
|
Exact-current-head automated review request for @coderabbitai review |
Rate Limit Exceeded
|
|
Exact-current-head source review request for Check that the job-level immutable Semgrep reference is complete, the preflight resolves the exact manifest, and the scan uses that same reference without changing existing rules, severities, exclusions, SARIF, permissions, credentials, or fail-closed behavior. Review read-only; no digest/tag weakening or merge bypass. @opencode-agent review |
Keep Semgrep OSS on a single SEMGREP_IMAGE digest, contract-test that the hex pin appears once, and document SLSA/NIST 800-190 pinning.
|
Reviewed. Added single-digest contract, CHANGELOG, and APA 7th doctoring (NIST SP 800-190, SLSA 1.0). Local suite 977 passed x2, coverage 100%. Auto-merge armed. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
24ca6081e4704ca176ca02015cbbf27e07fbf832. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31663091881/job/94331866046)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31663091881/job/94331866046)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: sast-semgrep.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: sast-semgrep.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: semgrep-image-digest-single-source.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: semgrep-image-digest-single-source.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: sast-semgrep.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: sast-semgrep.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: semgrep-image-digest-single-source.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: semgrep-image-digest-single-source.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: materialize_base_python_requirements.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: materialize_base_python_requirements.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
8fabd327773eb5346f307ffdaa633b2e9f026c9a. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Bandit (Python SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653442/job/94503167337)
- Close Empty PR/close-empty: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716651445/job/94502964300)
- CodeQL PR/Detect CodeQL languages: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653267/job/94502971155)
- Detect CodeQL languages check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653267/job/94502971155)
- Detect Python check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653442/job/94502971493)
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716654160/job/94502975477)
- Python 3.10 compatibility contract check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653129/job/94502970921)
- Python 3.14 full quality gate check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653129/job/94502970922)
- Python Security/Bandit (Python SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653442/job/94503167337)
- Python Security/Detect Python: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653442/job/94502971493)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653442/job/94503167389)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653070/job/94502970936)
- SBOM Generation/generate-sbom: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653144/job/94502970610)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716652995/job/94502970596)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716652995/job/94502970596)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653303/job/94502971510)
- Security Scan/dependency-review: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653162/job/94502971668)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653162/job/94502971714)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653162/job/94502971614)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653162/job/94502971652)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653070/job/94502970936)
- Strix Changed Path Quality CI/exact-head-path-policy: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653310/job/94502971227)
- Trusted uv Materializer Quality CI/Python 3.10 compatibility contract: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653129/job/94502970921)
- Trusted uv Materializer Quality CI/Python 3.14 full quality gate: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653129/job/94502970922)
- close-empty check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716651445/job/94502964300)
- coverage-source-tree check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716651487/job/94503195182)
- dependency-review check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653162/job/94502971668)
- exact-head-path-policy check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653310/job/94502971227)
- generate-sbom check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653144/job/94502970610)
- gitleaks (secret scan) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653303/job/94502971510)
- osv-scan / osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716654160/job/94502975477)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653162/job/94502971714)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653442/job/94503167389)
- required-workflow-bootstrap check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716651487/job/94502965523)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653162/job/94502971614)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716653162/job/94502971652)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: sast-semgrep.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: sast-semgrep.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: semgrep-image-digest-single-source.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: semgrep-image-digest-single-source.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: materialize_base_python_requirements.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: materialize_base_python_requirements.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
Returned to Draft because the exact current tree contradicts the body’s “Semgrep workflow only” scope. The valid repair is bounded: one job-level immutable Rebuild from protected |
|
@coderabbitai review Review only exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr_number='941'
head='6015981514956977ebf18e74f3441b3bc560a679'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
workflow='.github/workflows/sast-semgrep.yml'
printf '%s\n' '== Local commit verification =='
printf 'checked_out_head='
git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
printf '%s\n' '== Changed files =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Changed-file diff summary =='
git diff --stat "$base" "$head"
printf '%s\n' '== Full exact-head diff =='
git diff --no-ext-diff --unified=100 "$base" "$head"
printf '%s\n' '== Semgrep workflow structure =='
ast-grep outline "$workflow" --items all
printf '%s\n' '== Semgrep controls at exact head =='
git show "${head}:${workflow}" | nl -ba | \
grep -E -C 6 'SEMGREP_IMAGE|semgrep/semgrep|docker manifest inspect|docker run|--config=|--severity=|--exclude=|--sarif|--error|--metrics=off|permissions:|SEMGREP_APP_TOKEN' || true
printf '%s\n' '== PR refs =='
gh api "repos/${repo}/pulls/${pr_number}" \
--jq '{head_sha: .head.sha, base_sha: .base.sha, state, draft}'
printf '%s\n' '== Check runs at requested head =='
gh api --paginate "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, app: .app.slug}'
printf '%s\n' '== Commit statuses at requested head =='
gh api --paginate "repos/${repo}/commits/${head}/status?per_page=100" \
--jq '.statuses[] | {context, state, creator: .creator.login}'
printf '%s\n' '== Pull-request reviews =='
gh api --paginate "repos/${repo}/pulls/${pr_number}/reviews?per_page=100" \
--jq '.[] | {user: .user.login, state, commit_id, submitted_at}'
printf '%s\n' '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 43341
Finding — PR scope is still broader than the bounded Semgrep repair.
The requested head and base match PR You are interacting with an AI system. |
1 participant
Summary
SEMGREP_IMAGEvariable;docker run;The unchanged digest remains:
semgrep/semgrep@sha256:2b33f46ba66cf8cc2ad59ccfa7d22951fd00c632c38f1339e84ec8e6e641a942Scan scope, severities, SARIF handling, credentials, permissions, metrics-off behavior, and the existing fail-closed Semgrep gate remain unchanged.
Exact-current-head verification
main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;5f51364418eb6e17300e771f9738d0580acad115;.github/workflows/sast-semgrep.ymlonly;31598619582, job94120163405: terminal success;Verify pinned Semgrep manifeststep completed successfully before the scan;Merge only after every required current-head check, zero valid unresolved findings, and the required qualifying independent approvals pass.