From 1b3fda0dd594df0f4eedfef264d3af9fe81b3784 Mon Sep 17 00:00:00 2001 From: Dmitrii Creed Date: Sun, 24 May 2026 19:34:16 +0400 Subject: [PATCH 1/2] ci: disable two over-broad Semgrep registry rules with replacement coverage Cuts the 10 WARNING findings the Semgrep job posts on every PR by disabling two registry rules whose threat models don't apply to SC code. Reachability-aware replacement coverage lives in the shared `go-canon.yml` ruleset: - `go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5`: fires on every md5.Sum() regardless of context. All 7 SC call sites are non-cryptographic fingerprints (S3-etag-style upload checksums, K8s annotation change-hashes, dedup suffix for Pulumi resource names on duplicate-name DNS records). Real MD5-in-crypto use is now caught by the narrower `go-md5-in-crypto-context` rule shipped in actions#23. - `go.lang.security.deserialization.unsafe-deserialization-interface .go-unsafe-deserialization-interface`: calibrated to Python pickle/yaml.load (which executes code on unmarshal). Go's yaml.v3 and encoding/json do not execute on unmarshal; threat model doesn't transfer. The 3 SC call sites are credential obfuscators (commands_project.go, secure_file_reader.go) that walk untyped YAML specifically to redact secrets BEFORE logging. Bumps the SC actions reusable-workflow pin to the head commit of chore/semgrep-disable-rules-and-md5-refinement (actions#23, which adds the `disabled-rules` input). Pin must be bumped to the main-merge SHA before this PR merges. Signed-off-by: Dmitrii Creed --- .github/workflows/semgrep.yml | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 9f9ac17c..1dd6a1dd 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -9,7 +9,10 @@ permissions: contents: read jobs: semgrep: - uses: simple-container-com/actions/.github/workflows/semgrep.yml@0af5a697f24ea484991660619d0ae42d50343b9d # main + # NOTE: pinned to the chore/semgrep-disable-rules-and-md5-refinement + # head SHA on simple-container-com/actions until that PR (actions#23) + # merges; bump to the resulting main-merge SHA before merging this PR. + uses: simple-container-com/actions/.github/workflows/semgrep.yml@2a7604ddac4fd9f912a1ab6896ac87c5b07bc537 # chore/semgrep-disable-rules-and-md5-refinement (actions#23) permissions: contents: read with: @@ -29,3 +32,27 @@ jobs: # Pinned at the action level via Semgrep image digest in # semgrep-scan/action.yml; pack content is fetched at runtime. registry-packs: 'p/ci,p/golang,p/gosec' + # Suppress two over-broad registry rules whose threat models don't + # transfer to SC code. Replacement coverage: + # + # `use-of-md5` — gosec fires on every md5.Sum call. All 7 SC + # call sites are non-cryptographic fingerprints: S3-etag-style + # bundle checksums (static_website.go, bucket_uploader.go), + # K8s annotation change-hashes for Caddy restart triggers + # (gke_autopilot_stack.go, kube_run.go), and a dedup suffix for + # Pulumi resource names on duplicate-name DNS records + # (registrar.go). Real MD5-in-crypto coverage is provided by + # `go-md5-in-crypto-context` in go-canon.yml, which fires on + # `hmac.New(md5.New, ...)` and on md5 result assigned to + # variables named `mac` / `signature` / `password` / etc. + # + # `unsafe-deserialization-interface` — calibrated to Python + # pickle / yaml.load which execute code on unmarshal. Go's + # yaml.v3 / encoding-json do not execute on unmarshal; the + # threat model doesn't transfer. The 3 SC call sites are + # credential obfuscators that walk untyped YAML to redact + # secrets BEFORE logging (commands_project.go, + # secure_file_reader.go). The SC team explicitly dropped its + # own equivalent rule in round-6 triage for the same reason + # (see go-canon.yml comment in actions repo). + disabled-rules: 'go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5,go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface' From 4a2f8282bec651c6b43f7b427b0b8ed82a2113ec Mon Sep 17 00:00:00 2001 From: Dmitrii Creed Date: Sun, 24 May 2026 20:19:58 +0400 Subject: [PATCH 2/2] ci(semgrep): bump actions pin to post-merge main SHA (actions#23 merged) Signed-off-by: Dmitrii Creed --- .github/workflows/semgrep.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 1dd6a1dd..f2c7c292 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -9,10 +9,7 @@ permissions: contents: read jobs: semgrep: - # NOTE: pinned to the chore/semgrep-disable-rules-and-md5-refinement - # head SHA on simple-container-com/actions until that PR (actions#23) - # merges; bump to the resulting main-merge SHA before merging this PR. - uses: simple-container-com/actions/.github/workflows/semgrep.yml@2a7604ddac4fd9f912a1ab6896ac87c5b07bc537 # chore/semgrep-disable-rules-and-md5-refinement (actions#23) + uses: simple-container-com/actions/.github/workflows/semgrep.yml@5061c0a28f850f4d8f5f990856cd31c9699760fc # main (actions#23 merged) permissions: contents: read with: