From b4fd4bbc7e3eed1a805c079e44b25c2ea4a45e3f Mon Sep 17 00:00:00 2001 From: Georges-Antoine Assi Date: Tue, 4 Aug 2026 12:27:17 -0400 Subject: [PATCH] perf(ci): scope semgrep-general to ERROR-severity rules MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PROPOSAL — needs a security-team call before merging. p/trailofbits accounts for 11.0 of semgrep-general's 12.5 min, and its cost sits in the non-ERROR rules. Measured on CI: all three heavy packs with --severity=ERROR run in 1.4 min. The tradeoff is real. This drops 474 rules that apply to the languages this job scans, all WARNING/INFO/MEDIUM, and keeps all 189 ERROR ones. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci-security.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci-security.yaml b/.github/workflows/ci-security.yaml index 9cbe9fd1b036..63a361687064 100644 --- a/.github/workflows/ci-security.yaml +++ b/.github/workflows/ci-security.yaml @@ -341,6 +341,7 @@ jobs: --exclude-rule trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport \ --exclude-rule trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces \ --exclude-rule yaml.github-actions.security.audit.unsafe-add-mask-workflow-command.unsafe-add-mask-workflow-command \ + --severity=ERROR \ --error \ --metrics=off \ --verbose \