Repository navigation
Update semgrep runner - #4356
Conversation
dosubot
Bot
added
the
size:XXL
WalkthroughThe updates include changing the Semgrep workflow runner to Ubuntu 24.04, documenting a macOS crash fix in the changelog, and enhancing a safety check in the Changes
Sequence Diagram(s)sequenceDiagram
participant App
participant macosWebviewWindow
participant ParentWindow
App->>macosWebviewWindow: execJS(jsCode)
macosWebviewWindow->>macosWebviewWindow: Check nsWindow == nil
macosWebviewWindow->>ParentWindow: isDestroyed()
alt nsWindow is nil or ParentWindow is destroyed
macosWebviewWindow-->>App: Return (do not execute JS)
else
macosWebviewWindow->>macosWebviewWindow: Execute JS
end
Poem
📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (8)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
dosubot
Bot
added
size:XS
github-actions
Bot
added
Documentation
Deploying wails with
|
| Latest commit: |
1627297
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://c15ed875.wails.pages.dev |
| Branch Preview URL: | https://semgrep-1.wails.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
v3/pkg/application/webview_window_darwin.go (1)
1041-1054: Extra destroyed-window guard LGTMThe added
w.parent.isDestroyed()check prevents crashes when async JS executes after the window is closed.
No further issues spotted –C.CStringallocation happens only when the guard passes, so no leaked C strings.If you ever make
w.parentoptional, add a nil check to avoid a panic:if w.nsWindow == nil || w.parent == nil || w.parent.isDestroyed() { return }
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/workflows/semgrep.yml(1 hunks)docs/src/content/docs/changelog.mdx(1 hunks)v3/pkg/application/webview_window_darwin.go(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: Run Go Tests v3 (macos-latest, 1.24)
- GitHub Check: Cloudflare Pages
🔇 Additional comments (2)
.github/workflows/semgrep.yml (1)
18-18:Details
❓ Verification inconclusive
Runner bump looks fine – but pin the container image for reproducibility
ubuntu-24.04is already generally available, so the runner switch is OK.
However, the workflow still pullsreturntocorp/semgrepwithout a tag or digest, meaning every run may use a different Semgrep version.- image: returntocorp/semgrep + # Pin to a specific Semgrep version to avoid unexpected CI breakages + image: returntocorp/semgrep:1.88.0Pinning avoids silent upgrades that could fail the pipeline or produce inconsistent results.
Also double-check that the chosen Semgrep tag supports Ubuntu 24.04 (glibc/glibcxx compatibility).
🏁 Script executed:
#!/bin/bash grep -R "returntocorp/semgrep" -n .github/workflows/semgrep.yml || echo "Not found"Length of output: 100
🏁 Script executed:
#!/usr/bin/env bash # 1. Check if the suggested Semgrep tag 1.88.0 exists on Docker Hub echo "Checking for tag 1.88.0..." curl -s "https://registry.hub.docker.com/v2/repositories/returntocorp/semgrep/tags?page_size=300" \ | jq -r '.results[].name' \ | grep -x "1.88.0" \ && echo "✅ Tag '1.88.0' found" \ || echo "❌ Tag '1.88.0' not found" # 2. Determine the latest available 1.x.x Semgrep tag echo "Determining latest 1.x.x Semgrep tag..." latest=$(curl -s "https://registry.hub.docker.com/v2/repositories/returntocorp/semgrep/tags?page_size=300" \ | jq -r '.results[].name' \ | grep -E '^1\.[0-9]+\.[0-9]+$' \ | sort -V \ | tail -n1) echo "Latest Semgrep tag: $latest"Length of output: 604
Pin the Semgrep container image for reproducible CI
The workflow currently uses an untagged image:
image: returntocorp/semgrepThat implicitly pulls
lateston every run, risking silent upgrades and CI breakages. Pin it to a specific Semgrep release:- image: returntocorp/semgrep + image: returntocorp/semgrep:<SEMgrep-version> # e.g. 1.88.0 or the latest stable tag• Update
.github/workflows/semgrep.yml(line 22) to include a fixed tag
• Verify the chosen tag exists on Docker Hub: https://hub.docker.com/r/returntocorp/semgrep/tags
• No host glibc/glibcxx concerns—containers bundle their own runtimedocs/src/content/docs/changelog.mdx (1)
131-131: No technical concerns – entry correctly documents the fix.
|
* Update semgrep workflow --------- Co-authored-by: joshhardy <joshhardy@users.noreply.github.com>
* Update semgrep workflow --------- Co-authored-by: joshhardy <joshhardy@users.noreply.github.com>
3 participants
Description
Ubuntu-20.04 was deprecated.
Summary by CodeRabbit
Bug Fixes
Documentation
Chores