From d83bb00d0980b5e3f18e55505f747621b64e39c4 Mon Sep 17 00:00:00 2001 From: Michal Landsman Date: Fri, 31 Jul 2026 14:34:48 +0200 Subject: [PATCH] Scan web and supabase with semgrep, calling the shared workflow Both PR pipelines gain a security job calling landsman/config, so the scanner and the image have one place to change rather than one per repo. p/typescript on both rather than a Deno pack: p/deno 404s in the registry, and this is TypeScript whatever runs it. Checked against the image, not assumed -- an unknown pack fails the run rather than being ignored. Run locally against the mirror first: 110 rules over 74 files in src/web and 49 in supabase, both clean. --- .github/workflows/pr-supabase.yml | 11 +++++++++++ .github/workflows/pr-web.yml | 11 +++++++++++ 2 files changed, 22 insertions(+) diff --git a/.github/workflows/pr-supabase.yml b/.github/workflows/pr-supabase.yml index 39f8353..c81f955 100644 --- a/.github/workflows/pr-supabase.yml +++ b/.github/workflows/pr-supabase.yml @@ -51,3 +51,14 @@ jobs: with: directory: ./supabase/functions title: "Deno Outdated - Supabase" + + # The scan lives in landsman/config and is called, not copied — one place to + # change the scanner, the image or a default pack for every repo of mine. + # Its own job so a finding reads as a finding rather than as a broken build. + # p/typescript rather than a Deno pack: p/deno does not exist in the registry, + # and this is TypeScript whatever runs it. + security: + uses: landsman/config/.github/workflows/semgrep.yml@main + with: + packs: p/secrets p/typescript + path: supabase diff --git a/.github/workflows/pr-web.yml b/.github/workflows/pr-web.yml index 5c158a9..460a175 100644 --- a/.github/workflows/pr-web.yml +++ b/.github/workflows/pr-web.yml @@ -49,3 +49,14 @@ jobs: with: directory: ./src/web title: "Deno Outdated - Web" + + # The scan lives in landsman/config and is called, not copied — one place to + # change the scanner, the image or a default pack for every repo of mine. + # Its own job so a finding reads as a finding rather than as a broken build. + # p/typescript rather than a Deno pack: p/deno does not exist in the registry, + # and this is TypeScript whatever runs it. + security: + uses: landsman/config/.github/workflows/semgrep.yml@main + with: + packs: p/secrets p/typescript + path: src/web