ci(sast): blocking Semgrep gate on the untrusted-document parsing surface (maturity X4) - #1012
Conversation
…face (maturity X4) The repo-wide Semgrep job stays advisory (registry rules are mutable), but the paths that open attacker-supplied uploads now get a second, path-scoped job with no continue-on-error: worker/** (including the Python OCR stack via p/python), src/lib/ingestion*.ts, src/lib/extractors, and the ingestion/upload API routes. ERROR-severity findings there fail the workflow instead of merely advising. Triage-first per the workorder: the CI-pinned semgrep/semgrep:1.168.0 image run over the scoped paths reports 0 ERROR findings (24 TS rules / 17 files, 55 Python rules / 3 files), so the gate starts green. check-github-action-pins.mjs now enforces both halves of the policy fail-closed: the repo-wide scan step must remain advisory, and the ingestion gate must exist, must not carry continue-on-error, and must keep its target scope and p/python config. Verification: exact gate command green in the pinned container (exit 0), check:github-actions, check:ci-scope, yaml-contract vitest, verify:cheap (3031 tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthroughA new blocking Semgrep job scans the untrusted ingestion and parsing surface for ERROR findings. CI validation now requires the job, scoped targets, Python ruleset, and digest-pinned image, while review and maturity records document the completed gate. ChangesIngestion SAST gate
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/sast.yml:
- Around line 67-68: Pin the semgrep-ingestion-gate container in
.github/workflows/sast.yml at lines 67-68 to a verified `@sha256`: digest instead
of the mutable 1.168.0 tag. Update check-github-action-pins.mjs at lines 79-103
to reject tag-only references for semgrep-ingestion-gate. Update the related
tracking entries in docs/branch-review-ledger.md:664 and
docs/maturity-backlog-workorders.md:97-102 to reflect the completed digest
pinning and enforcement changes.
In `@docs/branch-review-ledger.md`:
- Line 664: The X4 completion records use a future date and prematurely mark the
work as shipped. In docs/branch-review-ledger.md lines 664-664, defer the entry
or replace its date with the actual completion date; in
docs/maturity-backlog-workorders.md lines 88-102, remove the “Shipped
2026-07-21” claim; and at lines 198-198, restore the non-completed status until
the gate has shipped.
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: fe8059bd-8914-45de-81f0-a59080b728cb
📒 Files selected for processing (4)
.github/workflows/sast.ymldocs/branch-review-ledger.mddocs/maturity-backlog-workorders.mdscripts/check-github-action-pins.mjs
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. The agent ran but didn't make any changes. The issues may already be fixed or require manual intervention. |
…in pins check Review follow-up (PR #1012): the blocking job's engine must be immutable, so the gate now uses the sha256 digest of the exact semgrep/semgrep:1.168.0 image the X4 triage ran, and check-github-action-pins.mjs rejects a tag-only reference for that job. Tracking docs updated to record the digest pinning. The advisory job keeps its tag deliberately - it is non-blocking by policy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Review findings dispositioned:
|
1 participant
What
Completes maturity workorder X4: Semgrep ERROR findings now block on the untrusted-document parsing surface instead of merely advising.
semgrep-ingestion-gatejob insast.yml— nocontinue-on-error— scoped toworker/**,src/lib/ingestion*.ts,src/lib/extractors,src/app/api/ingestion,src/app/api/upload, using the same pinnedsemgrep/semgrep:1.168.0image and rule packs as the advisory job, plusp/pythonso the worker's OCR stack (the code that actually opens untrusted PDFs) is covered.check-github-action-pins.mjsnow enforces both halves of the policy fail-closed: the repo-wide scan step must remain advisory, and the ingestion gate must exist, must not carrycontinue-on-error, and must keep its target scope andp/python.docs/maturity-backlog-workorders.md: X4 marked DONE with triage evidence.Triage (the workorder's precondition)
Ran the CI-pinned image over the scoped paths locally via Docker before flipping the gate: 0 ERROR findings (24 TS rules / 17 files; 55 Python rules / 3 files) — the gate starts green with no code changes or suppressions.
Risk
Verification
check:github-actions(incl. the new assertions, verified fail-closed),check:ci-scope, yaml-contract vitestnpm run verify:cheapgreen (337 files / 3031 tests)🤖 Generated with Claude Code
Summary by CodeRabbit
Security
Documentation
CI / Maintenance