Skip to content

ci: enable repo Semgrep rules for issue #338 #354

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
acgetchell merged 5 commits into from
Apr 30, 2026
Merged

ci: enable repo Semgrep rules for issue #338 #354

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
598f4d0
ci: enable repo Semgrep rules for issue #338
acgetchell Apr 29, 2026
fb9f3de
ci: enable repository Semgrep rules
acgetchell Apr 29, 2026
ffce8f8
ci: expand repository Semgrep rules
acgetchell Apr 29, 2026
1a5fd6a
ci: refresh quality tooling and diagnostics
acgetchell Apr 29, 2026
fb99dbb
fix: harden Hilbert ordering errors and prelude checks (#338)
acgetchell Apr 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions .codacy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,14 @@
#
# Recommended enabled tools:
# - markdownlint: documentation linting
# - opengrep: repository-owned Rust Semgrep rules from semgrep.yaml
# - ruff: Python utility linting
# - shellcheck: shell-script linting
# - duplication: advisory duplicate-code metric
# - lizard: advisory complexity feedback
#
# Recommended disabled tools:
# - bandit, prospector, pylintpython3: redundant with Ruff/ty for this repo
# - opengrep: keep broad/default rules disabled until repo-owned rules in
# .semgrep.yaml are cleaned up and enabled
# - trivy: dependency vulnerability scanning is handled by cargo-audit and
# Dependabot unless this repository adds containers or IaC
# - jacksonlinter, spectral: not relevant to the current project surface
Expand Down Expand Up @@ -50,6 +49,9 @@ engines:
- "**/*.md"
config:
file: ".markdownlint.json"
opengrep:
include_paths:
- "src/**/*.rs"
ruff:
include_paths:
- "scripts/**/*.py"
Expand All @@ -62,3 +64,5 @@ exclude_paths:
- "node_modules/**"
- ".git/**"
- "docs/archive/**"
# Semgrep fixtures intentionally contain bad examples for rule tests.
- "tests/semgrep/**"
8 changes: 4 additions & 4 deletions .coderabbit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,11 +106,11 @@ reviews:
yamllint:
enabled: true

# Semantic code analysis is intentionally disabled until the staged,
# repository-owned rules in .semgrep.yaml are enabled after legacy cleanup.
# Default Semgrep packs are noisy here and duplicate CodeQL/cargo-audit.
# Semantic code analysis uses only the focused, repository-owned rules in
# semgrep.yaml. Default Semgrep packs remain disabled in CodeRabbit.
semgrep:
enabled: false
enabled: true
Comment on lines +109 to +112
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

find . -name ".semgrep.yaml" -o -name "semgrep.yaml" -o -name "semgrep.yml" -o -name "semgrep.config.yml" -o -name "semgrep.config.yaml" 2>/dev/null | head -20

Repository: acgetchell/delaunay

Length of output: 79

🌐 Web query:

CodeRabbit Semgrep config file auto-discovery behavior documentation

💡 Result:

CodeRabbit's Semgrep config file auto-discovery behavior is documented in the official docs at https://docs.coderabbit.ai/tools/semgrep. By default, CodeRabbit automatically uses Semgrep config files named semgrep.yml, semgrep.yaml, semgrep.config.yml, or semgrep.config.yaml if present in the root directory of the repository. Semgrep only runs if a config file is found using these default names, or if a custom path is explicitly specified via: - reviews.tools.semgrep.config_file in the repository's .coderabbit.yaml file, or - The "Reviews → Tools → Semgrep → Config File" field in CodeRabbit's web settings UI. Due to licensing restrictions, CodeRabbit does not include community Semgrep rules and requires a user-provided config with rules. Note that the related OpenGrep tool (Semgrep-compatible) has a broader fallback search order including Semgrep files, starting from repo root and PR-changed files, then broader search—but Semgrep itself sticks to root defaults or explicit paths.

Citations:

Add config_file: .semgrep.yaml to enable Semgrep with repository-owned rules.

CodeRabbit auto-discovers only semgrep.yml, semgrep.yaml, semgrep.config.yml, and semgrep.config.yaml. This repository uses .semgrep.yaml, which falls outside the auto-discovery pattern. Setting enabled: true alone will not load your repository-owned rules. Explicitly specify the config file path to enable Semgrep properly.

Suggested fix 
     semgrep:
       enabled: true
+      config_file: .semgrep.yaml
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Semantic code analysis uses only the focused, repository-owned rules in
# .semgrep.yaml. Default Semgrep packs remain disabled in CodeRabbit.
semgrep:
enabled: false
enabled: true
# Semantic code analysis uses only the focused, repository-owned rules in
# .semgrep.yaml. Default Semgrep packs remain disabled in CodeRabbit.
semgrep:
enabled: true
config_file: .semgrep.yaml
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.coderabbit.yml around lines 109 - 112, Add the repository-owned Semgrep
config path under the existing semgrep section so CodeRabbit loads
.semgrep.yaml: in the .coderabbit.yml semgrep block (the keys "semgrep" and
"enabled") add a "config_file: .semgrep.yaml" entry alongside enabled: true to
explicitly point CodeRabbit to the repository's Semgrep rules file.

config_file: semgrep.yaml

# Python linter (ruff provides comprehensive Python analysis)
ruff:
Expand Down
10 changes: 6 additions & 4 deletions .github/workflows/audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ permissions:
jobs:
audit:
runs-on: ubuntu-latest
env:
CARGO_AUDIT_VERSION: "0.22.1"
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Expand All @@ -40,14 +42,14 @@ jobs:
# toolchain, components, etc. are specified in rust-toolchain.toml

- name: Cache audit database
uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: ~/.cargo/advisory-db
key: advisory-db-${{ github.ref_name }}-v1
restore-keys: advisory-db-

- name: Install cargo-audit
run: cargo install --locked cargo-audit
run: cargo install --locked cargo-audit --version "${CARGO_AUDIT_VERSION}"

- name: Run cargo audit
run: |
Expand All @@ -71,14 +73,14 @@ jobs:

- name: Upload audit SARIF results
if: always()
uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
uses: github/codeql-action/upload-sarif@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4
with:
sarif_file: audit-results.sarif
category: "cargo-audit"
wait-for-processing: true

- name: Upload audit results
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: audit-results
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/benchmarks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -302,7 +302,7 @@ jobs:

- name: Upload regression test results
if: env.BASELINE_EXISTS == 'true' && env.SKIP_BENCHMARKS == 'false' && always()
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: performance-regression-results-${{ github.run_number }}
path: |
Expand Down
42 changes: 25 additions & 17 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,15 @@ on:
env:
CARGO_TERM_COLOR: always
RUST_BACKTRACE: 1
ACTIONLINT_VERSION: "1.7.10"
MARKDOWNLINT_VERSION: "0.47.0"
SHFMT_VERSION: "3.12.0"
TYPOS_VERSION: "1.43.4"
ACTIONLINT_VERSION: "1.7.12"
JUST_VERSION: "1.50.0"
MARKDOWNLINT_VERSION: "0.48.0"
SHFMT_VERSION: "3.13.1"
SHFMT_SHA256_DARWIN_AMD64: "6feedafc72915794163114f512348e2437d080d0047ef8b8fa2ec63b575f12af"
SHFMT_SHA256_DARWIN_ARM64: "9680526be4a66ea1ffe988ed08af58e1400fe1e4f4aef5bd88b20bb9b3da33f8"
SHFMT_SHA256_LINUX_AMD64: "fb096c5d1ac6beabbdbaa2874d025badb03ee07929f0c9ff67563ce8c75398b1"
TAPLO_VERSION: "0.10.0"
TYPOS_VERSION: "1.45.2"
UV_VERSION: "0.11.8"

jobs:
Expand Down Expand Up @@ -57,9 +62,9 @@ jobs:

- name: Install just
if: matrix.os != 'windows-latest'
uses: taiki-e/install-action@cf525cb33f51aca27cd6fa02034117ab963ff9f1 # v2.75.22
uses: taiki-e/install-action@b651345a718c8f44efa2460560b3dbf29cbd7ee1 # v2.75.26
with:
tool: just
tool: just@${{ env.JUST_VERSION }}

- name: Install uv (for Python scripts and pytest)
if: matrix.os != 'windows-latest'
Expand All @@ -80,15 +85,15 @@ jobs:

- name: Install typos-cli
if: matrix.os != 'windows-latest'
uses: taiki-e/install-action@cf525cb33f51aca27cd6fa02034117ab963ff9f1 # v2.75.22
uses: taiki-e/install-action@b651345a718c8f44efa2460560b3dbf29cbd7ee1 # v2.75.26
with:
tool: typos-cli@${{ env.TYPOS_VERSION }}

- name: Install taplo (for TOML formatting and linting)
if: matrix.os != 'windows-latest'
uses: taiki-e/install-action@cf525cb33f51aca27cd6fa02034117ab963ff9f1 # v2.75.22
uses: taiki-e/install-action@b651345a718c8f44efa2460560b3dbf29cbd7ee1 # v2.75.26
with:
tool: taplo-cli
tool: taplo-cli@${{ env.TAPLO_VERSION }}

- name: Install actionlint (Linux/macOS)
if: matrix.os != 'windows-latest'
Expand Down Expand Up @@ -169,20 +174,18 @@ jobs:
# Install shfmt (pinned for CI consistency)
SHFMT_ASSET="shfmt_v${SHFMT_VERSION}_linux_amd64"
SHFMT_BASE_URL="https://github.com/mvdan/sh/releases/download/v${SHFMT_VERSION}"
SHFMT_SHA256="${SHFMT_SHA256_LINUX_AMD64}"

tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT

curl -fsSL \
"${SHFMT_BASE_URL}/${SHFMT_ASSET}" \
-o "$tmpdir/${SHFMT_ASSET}"
curl -fsSL \
"${SHFMT_BASE_URL}/sha256sums.txt" \
-o "$tmpdir/sha256sums.txt"

(
cd "$tmpdir"
grep -F " ${SHFMT_ASSET}" sha256sums.txt > checksum.txt
printf '%s %s\n' "$SHFMT_SHA256" "$SHFMT_ASSET" > checksum.txt
sha256sum -c checksum.txt
)

Expand All @@ -202,20 +205,25 @@ jobs:

SHFMT_ASSET="shfmt_v${SHFMT_VERSION}_darwin_${SHFMT_ARCH}"
SHFMT_BASE_URL="https://github.com/mvdan/sh/releases/download/v${SHFMT_VERSION}"
case "$SHFMT_ARCH" in
amd64) SHFMT_SHA256="${SHFMT_SHA256_DARWIN_AMD64}" ;;
arm64) SHFMT_SHA256="${SHFMT_SHA256_DARWIN_ARM64}" ;;
*)
echo "Unsupported shfmt architecture: $SHFMT_ARCH" >&2
exit 1
;;
esac

tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT

curl -fsSL \
"${SHFMT_BASE_URL}/${SHFMT_ASSET}" \
-o "$tmpdir/${SHFMT_ASSET}"
curl -fsSL \
"${SHFMT_BASE_URL}/sha256sums.txt" \
-o "$tmpdir/sha256sums.txt"

(
cd "$tmpdir"
grep -F " ${SHFMT_ASSET}" sha256sums.txt > checksum.txt
printf '%s %s\n' "$SHFMT_SHA256" "$SHFMT_ASSET" > checksum.txt
shasum -a 256 -c checksum.txt
)

Expand Down
28 changes: 17 additions & 11 deletions .github/workflows/codacy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,14 @@
# separate terms of service, privacy policy, and support
# documentation.

# This workflow checks out code, runs Codacy's Markdownlint engine only, and
# integrates the results with GitHub Advanced Security code scanning.
# This workflow checks out code, runs selected Codacy engines, and integrates
# the results with GitHub Advanced Security code scanning.
# For more information on the Codacy analysis action usage and
# parameters, see https://github.com/codacy/codacy-analysis-cli-action.
# For more information on Codacy Analysis CLI in general, see
# https://github.com/codacy/codacy-analysis-cli.

name: Codacy Markdownlint Scan
name: Codacy Quality Scan

concurrency:
# This concurrency group ensures that only one Codacy analysis runs at a time
Expand All @@ -30,7 +30,7 @@ permissions:
contents: read

jobs:
codacy-markdownlint-scan:
codacy-quality-scan:
permissions:
# for actions/checkout to fetch code
contents: read
Expand All @@ -39,9 +39,15 @@ jobs:
# only required for a private repository by
# github/codeql-action/upload-sarif to get the Action run status
actions: read
name: Codacy Markdownlint Scan
name: Codacy ${{ matrix.tool }} Scan
runs-on: ubuntu-latest
timeout-minutes: 30
strategy:
fail-fast: false
matrix:
tool:
- markdownlint
- opengrep
steps:
# Checkout the repository to the GitHub Actions runner
- name: Checkout code
Expand All @@ -51,17 +57,17 @@ jobs:
run: |
set -euo pipefail
echo "CODACY_WORKDIR=$RUNNER_TEMP/codacy-src" >> "$GITHUB_ENV"
echo "CODACY_SARIF=$RUNNER_TEMP/results.sarif" >> "$GITHUB_ENV"
echo "CODACY_SARIF=$RUNNER_TEMP/results-${{ matrix.tool }}.sarif" >> "$GITHUB_ENV"

- name: Prepare workspace copy without .git
run: |
set -euo pipefail
mkdir -p "$CODACY_WORKDIR"
rsync -a --delete --exclude '.git' ./ "$CODACY_WORKDIR/"

# Execute Codacy Analysis CLI with a single tool. The Codacy GitHub App may
# run curated PR-quality tools, but this SARIF workflow stays Markdownlint
# only so maintainability checks are not mirrored into GitHub Code Scanning.
# Execute Codacy Analysis CLI with one selected tool per matrix entry.
# Opengrep reads the repository-owned rules from semgrep.yaml; broad
# default Semgrep/Opengrep packs remain disabled.
- name: Run Codacy Analysis CLI
# Cap Codacy runtime so a hung analyzer does not consume the full job timeout.
timeout-minutes: 20
Expand All @@ -76,7 +82,7 @@ jobs:
directory: ${{ env.CODACY_WORKDIR }}
output: ${{ env.CODACY_SARIF }}
format: sarif
tool: markdownlint
tool: ${{ matrix.tool }}
skip-uncommitted-files-check: true
# Adjust severity of non-security issues
gh-code-scanning-compat: true
Expand Down Expand Up @@ -148,7 +154,7 @@ jobs:
PY

- name: Upload split SARIF files
uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
uses: github/codeql-action/upload-sarif@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4
with:
sarif_file: ${{ env.CODACY_SPLIT_SARIF_DIR }}
wait-for-processing: true
16 changes: 9 additions & 7 deletions .github/workflows/codecov.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@ jobs:
runs-on: ubuntu-latest
env:
CARGO_LLVM_COV_VERSION: "0.8.5"
JUST_VERSION: "1.50.0"
NEXTEST_VERSION: "0.9.133"
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand All @@ -38,7 +40,7 @@ jobs:
run: rustup component add llvm-tools-preview

- name: Cache cargo-llvm-cov
uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: ~/.cargo/bin/cargo-llvm-cov
key: cargo-llvm-cov-${{ runner.os }}-${{ env.CARGO_LLVM_COV_VERSION }}
Expand All @@ -58,14 +60,14 @@ jobs:
fi

- name: Install just
uses: taiki-e/install-action@cf525cb33f51aca27cd6fa02034117ab963ff9f1 # v2.75.22
uses: taiki-e/install-action@b651345a718c8f44efa2460560b3dbf29cbd7ee1 # v2.75.26
with:
tool: just
tool: just@${{ env.JUST_VERSION }}

- name: Install nextest
uses: taiki-e/install-action@cf525cb33f51aca27cd6fa02034117ab963ff9f1 # v2.75.22
uses: taiki-e/install-action@b651345a718c8f44efa2460560b3dbf29cbd7ee1 # v2.75.26
with:
tool: nextest
tool: nextest@${{ env.NEXTEST_VERSION }}

- name: Run tests with nextest (for JUnit XML)
run: |
Expand Down Expand Up @@ -202,14 +204,14 @@ jobs:
continue-on-error: true

- name: Archive coverage results
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: coverage-report
path: coverage/

- name: Archive test results
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: test-results
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,20 +41,20 @@ jobs:

- name: Initialize CodeQL
if: matrix.language != 'rust'
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
uses: github/codeql-action/init@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4
with:
languages: ${{ matrix.language }}
queries: security-extended

- name: Initialize CodeQL (Rust)
if: matrix.language == 'rust'
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
uses: github/codeql-action/init@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4
with:
languages: ${{ matrix.language }}
build-mode: none
queries: security-extended

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
uses: github/codeql-action/analyze@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4
with:
category: "/language:${{ matrix.language }}"
2 changes: 1 addition & 1 deletion .github/workflows/generate-baseline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,7 @@ jobs:
run: uv run benchmark-utils sanitize-artifact-name --tag "$TAG_NAME"

- name: Upload baseline artifact
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ${{ steps.safe_name.outputs.artifact_name }}
path: bench-target/baseline-artifact/
Expand Down
Loading
Loading