From 1db0f1391e105a7c8c39fd0559c8b0a68f71fd2f Mon Sep 17 00:00:00 2001 From: Sayan Samanta Date: Wed, 29 Apr 2026 10:56:00 -0700 Subject: [PATCH] ci: add Semgrep SAST scanning on pull requests Subscribes this repo to the shared Semgrep workflow in kernel/security-workflows as part of expanding the elevated vulnerability management scope to customer-facing SDKs (KERNEL-1191, INC-51 follow-up). Made-with: Cursor --- .github/workflows/semgrep.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 .github/workflows/semgrep.yml diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml new file mode 100644 index 0000000..94717a2 --- /dev/null +++ b/.github/workflows/semgrep.yml @@ -0,0 +1,17 @@ +name: Semgrep + +on: + pull_request: + branches: [main] + +permissions: + contents: read + pull-requests: write + +jobs: + scan: + uses: kernel/security-workflows/.github/workflows/semgrep.yml@main + with: + extra-configs: '--config p/javascript --config p/typescript --config p/trailofbits' + codebase-description: 'Stainless-generated TypeScript/Node SDK for the Kernel API (public npm package used by customers)' + secrets: inherit