CI: real-tool smoke for mobsfscan and eslint-security

.github/workflows/ci.yml

@@ -544,7 +544,7 @@ jobs:
           "$RUNNER_TEMP/venv/bin/pip" install --quiet --require-hashes --only-binary=:all: -r scripts/real-hub-requirements.txt
           echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"
           # upstream detect-secrets, not the bc-detect-secrets fork that checkov pulls in (same module name)
-          test "$("$RUNNER_TEMP/venv/bin/detect-secrets" --version)" = 1.5.0
+          "$RUNNER_TEMP/venv/bin/detect-secrets" --version | grep -qx 1.5.0
       - name: Install checkov (hash-locked, own venv so bc-detect-secrets cannot shadow detect-secrets)
         run: |
           set -euo pipefail
@@ -567,7 +567,7 @@ jobs:
           gem install --no-document --install-dir "$RUNNER_TEMP/gems" --bindir "$RUNNER_TEMP/gems/bin" rubocop -v 1.69.2
           echo "GEM_HOME=$RUNNER_TEMP/gems" >> "$GITHUB_ENV"
           echo "$RUNNER_TEMP/gems/bin" >> "$GITHUB_PATH"
-      - name: Install solhint 6.2.5 (package-lock integrity hashes)
+      - name: Install solhint 6.2.5, eslint 9.39.5 and eslint-plugin-security 4.2.1 (package-lock integrity hashes)
         run: |
           set -euo pipefail
           npm ci --ignore-scripts --silent --no-audit --no-fund --prefix scripts/real-hub-npm
@@ -808,6 +808,19 @@ jobs:
           echo "cfa9e5214e4925842f4bc849a64f8a7e6c5d0425fe98eac8d7b7bc60fdc17e07  brakeman-8.1.0.gem" | sha256sum -c -
           gem install --local --no-document --ignore-dependencies --install-dir "$RUNNER_TEMP/gems" --bindir "$RUNNER_TEMP/gems/bin" ./brakeman-8.1.0.gem
           GEM_HOME="$RUNNER_TEMP/gems" "$RUNNER_TEMP/gems/bin/brakeman" --version | grep -qF 8.1.0
+      - name: Install mobsfscan 1.1.0 (hash-locked, own venv, a wrapper puts it first on PATH so mobsfscan runs its pinned semgrep 1.172.0 and not the njsscan venv one)
+        run: |
+          set -euo pipefail
+          python3 -m venv "$RUNNER_TEMP/venv-mobsfscan"
+          "$RUNNER_TEMP/venv-mobsfscan/bin/pip" install --quiet --retries 5 --require-hashes --only-binary=:all: -r scripts/real-hub-requirements-mobsfscan.txt
+          mkdir -p "$RUNNER_TEMP/bin"
+          cat > "$RUNNER_TEMP/bin/mobsfscan" <<EOF
+          #!/bin/sh
+          PATH="$RUNNER_TEMP/venv-mobsfscan/bin:\$PATH" exec "$RUNNER_TEMP/venv-mobsfscan/bin/mobsfscan" "\$@"
+          EOF
+          chmod +x "$RUNNER_TEMP/bin/mobsfscan"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/venv-mobsfscan/bin/python" -c "import importlib.metadata as m; assert m.version('semgrep') == '1.172.0', m.version('semgrep')"
       - name: Real-tool canaries
         run: REQUIRE_REAL_HUB=1 bash scripts/test-review-checks-real-hub.sh
 

changelog.d/hub-real-smoke-12.md

@@ -0,0 +1,3 @@
+### Changed
+- The real-hub CI job now also runs real mobsfscan 1.1.0 and the project's own local eslint 9.39.5 with eslint-plugin-security 4.2.1 through `review_checks.sh` on fictional canaries, and fails unless each ran (no `not run`, no `NOT CHECKED`) and reported its rule on its canary file. mobsfscan scans a debuggable Android manifest and reports `android_manifest_debugging_enabled`; eslint-security runs `./node_modules/.bin/eslint` under an `eslint.config.mjs` that loads the security plugin (committed in the base, because the hub does not run a config the diff changes) and reports `security/detect-eval-with-expression` on a Node canary. Pins: mobsfscan from a hash-locked requirements file in its own venv (it pins semgrep 1.172.0, so a wrapper puts that venv first on PATH instead of the njsscan venv's semgrep); eslint and the plugin in the existing `scripts/real-hub-npm` package-lock (integrity hashes, `npm ci --ignore-scripts`). Both join the bounded hub-run retry loop.
+- psalm, sobelow and licensee are not added. psalm: the hub keeps only rows with an `is_security` field, which psalm 6.20.11 does not emit (7.x does), and psalm 7.4.0's platform check needs PHP 8.3.16 or newer while the runner ships 8.3.6, so it would need a third-party PHP setup action. sobelow needs an Erlang/OTP and Elixir toolchain the runner does not ship, with no checksum-pinned install path. licensee is an inventory line the hub never counts as a scan that ran, and its dependency set includes natively built gems (rugged) that cannot be hash-locked without a Bundler lockfile.