From 0e357da9ac87b95d13c15c0ca75df68d8ee6be34 Mon Sep 17 00:00:00 2001
From: Georges-Antoine Assi <georges.a@posthog.com>
Date: Wed, 5 Aug 2026 07:30:45 -0400
Subject: [PATCH] fix(ci): stop semgrep-general timing out on every PR

semgrep-general was the only semgrep job without a changed-paths gate, so
it ran on 100% of PRs while scanning only the directories the other jobs
exclude. Its p50 is 12.3 min against a 20 min timeout, so slow runners
tripped it and blocked the required Semgrep Checks Pass check.

Gate it on the complement of its own --exclude list and raise the timeout
to 30, matching semgrep-python. Coverage is unchanged: master pushes and
oversized PRs still bypass the filter.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci-security.yaml | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-security.yaml b/.github/workflows/ci-security.yaml
index 9cbe9fd1b036..b5c1e7ee8c8a 100644
--- a/.github/workflows/ci-security.yaml
+++ b/.github/workflows/ci-security.yaml
@@ -31,6 +31,7 @@ jobs:
             rust: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.rust || 'true' }}
             js: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.js || 'true' }}
             products-frontend: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.products-frontend || 'true' }}
+            general: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.general || 'true' }}
             devex: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.devex || 'true' }}
             test-rules: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.test-rules || 'true' }}
             desktop: ${{ steps.oversized.outputs.force_all || steps.filter.outputs.desktop || 'true' }}
@@ -85,6 +86,22 @@ jobs:
                         - 'products/**'
                         - '.semgrep/rules/security/prefer-codegen-api.yaml'
                         - '.github/workflows/ci-security.yaml'
+                      # semgrep-general scans whatever the language-specific jobs
+                      # don't. Keep these excludes aligned with its --exclude list.
+                      general:
+                        - '**'
+                        - '!cli/**'
+                        - '!common/**'
+                        - '!ee/**'
+                        - '!frontend/**'
+                        - '!livestream/**'
+                        - '!nodejs/**'
+                        - '!posthog/**'
+                        - '!products/**'
+                        - '!rust/**'
+                        - '!.semgrep/**'
+                        - '!docs/**'
+                        - '!services/**'
                       # Keep these paths aligned with semgrep-devex's scan targets.
                       devex:
                         - 'bin/**'
@@ -308,8 +325,12 @@ jobs:
 
     # scans GitHub Actions and other repo-wide config
     semgrep-general:
+        needs: changes
+        if: needs.changes.outputs.general == 'true'
         runs-on: ubuntu-latest
-        timeout-minutes: 20
+        # The scan itself sits around 12 minutes, so 20 left too little headroom
+        # for a slow runner and the job was tripping the timeout.
+        timeout-minutes: 30
 
         env:
             DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USER }}