Repository navigation
CI: real-tool smoke for tflint, kics, cppcheck and devskim - #2369
Merged
Merged
Conversation
Adds real semgrep 1.157.0 (repo rules, no registry pack) and njsscan 0.4.2 canaries to the real-hub job. They install from their own hash-locked scripts/real-hub-requirements-semgrep.txt venv because semgrep pins click 8.1.8, jsonschema 4.25.1 and wcmatch 8.5.2, older than the versions the other tools resolve to. The trufflehog canary matches the exact detector name Github. provision_tools.sh pins checkov 3.4.5. review_checks.sh runs njsscan with the sandboxed HOME and no semgrep metrics, asserted by the hub stub test. Tests: 21/21 (hub secrets-node stub test; k8s-js and js-iac-license hub tests pass; real-hub canaries run in CI) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The real-hub semgrep and njsscan venv now resolves semgrep 1.182.1, the version provision_tools.sh installs for users (njsscan 0.4.2 is compatible). Its Linux wheels are manylinux_2_34, so the lock is re-derived for that platform. test-provision-tools.sh now expects the checkov==3.4.5 pin. Tests: 61/61 (test-provision-tools.sh) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The real-hub job now installs tflint 0.66.0 and kics 2.1.20 (sha256 from each release checksums.txt; kics queries from the release commit fetched by full sha and verified), cppcheck 2.13.0-2ubuntu3 (exact version from the signed noble archive; job pinned to ubuntu-24.04) and DevSkim CLI 1.0.100 (nupkg sha512 = nuget.org catalog packageHash). Each gets a fictional canary asserted through review_checks.sh: tool ran, expected rule on the canary file, no not-run or NOT CHECKED line. syft is skipped: the hub never counts it as ran. Tests: kics canary passes locally; tflint, cppcheck and devskim canaries run only in CI (not runnable in the local sandbox). Gates: bash -n, actionlint, privacy, size, size-ratchet, test-provision-tools.sh all green. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…x comments cppcheck is now the noble .deb fetched from its stable Launchpad URL and checked with sha256 (an exact apt version breaks once superseded); runtime deps still come from apt. The DevSkim nupkg is also checked with `dotnet nuget verify` when the runner's dotnet has that verb. The real-hub job header no longer calls cppcheck stub-only, and the raw kics rerun prints results.json even when kics exits non-zero. Tests: 5/5 gates (bash -n, actionlint, privacy, size, size-ratchet); test-provision-tools.sh passes against the committed provision_tools.sh (the worktree copy is stale and unrestorable in this sandbox). Canaries unchanged: kics ran locally earlier, tflint/cppcheck/devskim run in CI only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Conflicts in ci.yml and test-review-checks-real-hub.sh resolved in favor of the smoke-6 content (main holds the squashed smoke-5b changes it builds on). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extends the real-hub CI job to tflint 0.66.0 (bundled terraform ruleset, no plugin download), kics 2.1.20 (queries fetched at the sha of the release tag), cppcheck 2.13.0 and devskim 1.0.100. Each artifact is verified before use: tflint and kics against their upstream sha256 checksum files, cppcheck as a pinned .deb with sha256, and devskim as a nupkg with a pinned sha512, installed from a local source at the exact version. Each tool runs on one fictional canary file, and the job fails unless it ran and reported its expected rule there.
The job is pinned to ubuntu-24.04 so the cppcheck package stays installable. syft is not added: the hub counts it as an inventory, never as a scanner that ran.
Tests: the canaries run in CI; actionlint, bash -n, the size gate, the size ratchet, the privacy gate and test-provision-tools pass locally.
🤖 Generated with Claude Code