From 6247fbc5ed814dffe1dd7afc8186fca02b83ecbc Mon Sep 17 00:00:00 2001 From: Horia Stere Date: Fri, 28 Aug 2026 11:37:38 +0300 Subject: [PATCH 1/5] [MSDKS-2201] semgrep for iOS & Android --- .github/workflows/semgrep.yml | 86 +++++++++++++++++++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 .github/workflows/semgrep.yml diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml new file mode 100644 index 0000000..8e7e1b6 --- /dev/null +++ b/.github/workflows/semgrep.yml @@ -0,0 +1,86 @@ +name: Semgrep SAST Scan + +on: + push: + branches: + - master + - feature/MSDKS-2201-implement-gh-codeql + pull_request: + branches: [ "master" ] + schedule: + # Run a full scan every Monday at midnight + - cron: '0 0 * * 1' + workflow_dispatch: + +jobs: + semgrep-android: + name: Semgrep Scan (Android) + runs-on: ubuntu-latest + + permissions: + actions: read + contents: read + security-events: write + + container: + image: semgrep/semgrep:1.171.0@sha256:bdf7013b2c3634a487671158da77c554f531742326b543a9464d2adf6c433ac8 + + steps: + - name: Checkout Code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Run Semgrep Scan + run: >- + semgrep scan + --config p/security-audit + --config p/secrets + --config p/owasp-top-ten + --config p/kotlin + BlinkID/android + --sarif + --output=semgrep.sarif + + - name: Upload SARIF Results to GitHub Security Tab + uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + if: always() + with: + sarif_file: semgrep.sarif + category: semgrep-android + + semgrep-ios: + name: Semgrep Scan (iOS) + runs-on: ubuntu-latest + + permissions: + actions: read + contents: read + security-events: write + + container: + image: semgrep/semgrep:1.171.0@sha256:bdf7013b2c3634a487671158da77c554f531742326b543a9464d2adf6c433ac8 + + steps: + - name: Checkout Code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Run Semgrep Scan + run: >- + semgrep scan + --config p/security-audit + --config p/secrets + --config p/owasp-top-ten + --config p/swift + BlinkID/ios + --sarif + --output=semgrep.sarif + + - name: Upload SARIF Results to GitHub Security Tab + uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + if: always() + with: + sarif_file: semgrep.sarif + category: semgrep-ios From 68f54ef51af3b0c7aa7e7bf7644762631e1bc2c6 Mon Sep 17 00:00:00 2001 From: Horia Stere Date: Fri, 28 Aug 2026 11:56:56 +0300 Subject: [PATCH 2/5] [MSDKS-2201] add semgrep job for dart files --- .github/workflows/semgrep.yml | 37 +++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 8e7e1b6..690247b 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -84,3 +84,40 @@ jobs: with: sarif_file: semgrep.sarif category: semgrep-ios + + semgrep-dart: + name: Semgrep Scan (Dart) + runs-on: ubuntu-latest + + permissions: + actions: read + contents: read + security-events: write + + container: + image: semgrep/semgrep:1.171.0@sha256:bdf7013b2c3634a487671158da77c554f531742326b543a9464d2adf6c433ac8 + + steps: + - name: Checkout Code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Run Semgrep Scan + run: >- + semgrep scan + --config p/security-audit + --config p/secrets + --config p/owasp-top-ten + --config p/dart + BlinkID/lib + sample_files + --sarif + --output=semgrep.sarif + + - name: Upload SARIF Results to GitHub Security Tab + uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + if: always() + with: + sarif_file: semgrep.sarif + category: semgrep-dart From 074b3877a53a66f1aad2741009cf62caa1aa5d9a Mon Sep 17 00:00:00 2001 From: Horia Stere Date: Fri, 28 Aug 2026 12:08:13 +0300 Subject: [PATCH 3/5] [MSDKS-2201] log failing dart scan --- .github/workflows/semgrep.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 690247b..1e996c3 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -105,7 +105,7 @@ jobs: - name: Run Semgrep Scan run: >- - semgrep scan + semgrep scan --verbose --config p/security-audit --config p/secrets --config p/owasp-top-ten From 064118149a464042bd5f677d06731120095b7d80 Mon Sep 17 00:00:00 2001 From: Horia Stere Date: Fri, 28 Aug 2026 12:17:19 +0300 Subject: [PATCH 4/5] [MSDKS-2201] test dart scan --- .github/workflows/semgrep.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 1e996c3..a23442f 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -105,11 +105,10 @@ jobs: - name: Run Semgrep Scan run: >- - semgrep scan --verbose + semgrep scan --config p/security-audit --config p/secrets --config p/owasp-top-ten - --config p/dart BlinkID/lib sample_files --sarif From 99a2759d38f94ff2a8c6de1b5939bb60e8c9f258 Mon Sep 17 00:00:00 2001 From: Horia Stere Date: Fri, 28 Aug 2026 12:58:43 +0300 Subject: [PATCH 5/5] [MSDKS-2201] run semgrep only on master branch --- .github/workflows/semgrep.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index a23442f..49da8b7 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -4,7 +4,6 @@ on: push: branches: - master - - feature/MSDKS-2201-implement-gh-codeql pull_request: branches: [ "master" ] schedule: