[Feature] The secret and SAST scanners are in no CI job, only in check-full #593

New issue

Closed

opened 2026-07-22 16:18:11 +00:00 by brenno · 0 comments

brenno commented

2026-07-22 16:18:11 +00:00

Owner

Found in the pre-publication security review.

Evidence: .github/workflows/ci.yml defines the jobs gate, test-matrix, web-hardening, docs-links and supply-chain (Trivy, with exit-code: "0"). make check-secrets and make sast appear in none of them; Makefile:769 places them in check-full only. docs/CHECKS.md:139-142 confirms this with a dash in the CI column. The configuration is all present: .gitleaks.toml, .trufflehogignore, semgrep/ocideck.yaml, zap/baseline.conf.

(For the record: make sast is not a hollow target — semgrep has three rules, it runs, and it reports zero findings. I ran it.)

Why this matters now: four configuration files in the repository root make it look as though secret scanning and SAST are part of the pipeline. They are absent even from the declared pipeline, so on the day a runner does appear they still will not run. With a bus factor of one, "the committer runs it locally" is the weakest form of this control, and the repository does not make that difference visible where people look — the workflow file.

Proposal: add two steps to the gate job (make check-secrets, make sast) with the same honest note the existing steps carry about not yet running. Costs no runner and makes the intent checkable.

Secondary, lower priority: semgrep/ocideck.yaml holds three project-specific rules and no vendored community ruleset — a deliberate choice (no --config auto, therefore no network), but say so in docs/CHECKS.md under make sast, otherwise "SAST" reads wider than it is.

Found in the pre-publication security review. **Evidence:** `.github/workflows/ci.yml` defines the jobs `gate`, `test-matrix`, `web-hardening`, `docs-links` and `supply-chain` (Trivy, with `exit-code: "0"`). `make check-secrets` and `make sast` appear in none of them; `Makefile:769` places them in `check-full` only. `docs/CHECKS.md:139-142` confirms this with a dash in the CI column. The configuration is all present: `.gitleaks.toml`, `.trufflehogignore`, `semgrep/ocideck.yaml`, `zap/baseline.conf`. (For the record: `make sast` is not a hollow target — semgrep has three rules, it runs, and it reports zero findings. I ran it.) **Why this matters now:** four configuration files in the repository root make it look as though secret scanning and SAST are part of the pipeline. They are absent even from the *declared* pipeline, so on the day a runner does appear they still will not run. With a bus factor of one, "the committer runs it locally" is the weakest form of this control, and the repository does not make that difference visible where people look — the workflow file. **Proposal:** add two steps to the `gate` job (`make check-secrets`, `make sast`) with the same honest note the existing steps carry about not yet running. Costs no runner and makes the intent checkable. Secondary, lower priority: `semgrep/ocideck.yaml` holds three project-specific rules and no vendored community ruleset — a deliberate choice (no `--config auto`, therefore no network), but say so in `docs/CHECKS.md` under *make sast*, otherwise "SAST" reads wider than it is.

brenno added the

security

enhancement

labels

2026-07-22 16:18:11 +00:00

brenno referenced this issue from a commit

2026-07-22 17:21:33 +00:00

ci: zet de geheimen- en SAST-scan in de gedeclareerde pijplijn

brenno referenced this issue from a pull request that will close it,

2026-07-22 17:21:33 +00:00

ci: zet de geheimen- en SAST-scan in de gedeclareerde pijplijn (#593) #658

brenno closed this issue