You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
4.**Security scanning** - MANDATORY if any security tools detected:
97
+
- Dependency audit (npm audit, pnpm audit, etc.)
98
+
-**Semgrep SAST** - MUST run if detected in CI workflows or config files
99
+
5.**Tests** (run last as they take longest)
100
+
101
+
**CRITICAL: If Semgrep was detected in discovery (CI workflows, config files, or README), you MUST run it. Do NOT skip Semgrep and report "All checks passed" without running it.**
88
102
89
103
For each check, report:
90
104
- Pass - no issues found
@@ -121,17 +135,68 @@ For each check, report:
121
135
- Tests: `cargo test`
122
136
- Format check: `cargo fmt --check`
123
137
138
+
### Security Scanning Commands
139
+
140
+
**Dependency Audits (run based on detected package manager):**
141
+
- pnpm: `pnpm audit` or `pnpm audit:check` (if script exists in package.json)
142
+
- npm: `npm audit`
143
+
- yarn: `yarn audit`
144
+
- pip: `pip-audit` (if installed) or `safety check` (if installed)
145
+
- cargo: `cargo audit` (if installed)
146
+
147
+
**Semgrep (static analysis - MUST run if detected in CI or config):**
148
+
149
+
IMPORTANT: If Semgrep is detected in CI workflows or config files, you MUST run it as part of preflight checks. Do not skip it.
150
+
151
+
Detection order:
152
+
1. Check for custom script in package.json (e.g., `pnpm run semgrep` or `npm run semgrep`)
153
+
2. Check for semgrep config files: `.semgreprc.yml`, `.semgrep.yml`, `semgrep.yml`, or `.semgrep/` directory
154
+
3. Check `.github/workflows/*.yml` for semgrep jobs - extract `--config` flags used in CI
155
+
4.**Check `README.md` for documented semgrep commands** - ALWAYS check this before trying generic Docker commands, as projects often document the exact command needed for their setup
156
+
5. Check if `semgrep` CLI is available locally: `semgrep --version`
157
+
6. Check if Docker is available: `docker --version`
158
+
7. If Docker available but no semgrep CLI, use Docker (see platform-specific commands below)
CRITICAL: You MUST detect the platform and use the correct command automatically. Check the platform from the environment context.
168
+
169
+
-**If platform is `win32` (Windows):** ALWAYS use `MSYS_NO_PATHCONV=1` prefix for Docker commands:
170
+
```bash
171
+
MSYS_NO_PATHCONV=1 docker run --rm -v "$(pwd):/src" semgrep/semgrep semgrep scan --config auto /src
172
+
```
173
+
174
+
-**If platform is `darwin` (macOS) or `linux`:** Use standard Docker command:
175
+
```bash
176
+
docker run --rm -v "$(pwd):/src" semgrep/semgrep semgrep scan --config auto /src
177
+
```
178
+
179
+
**Why this matters on Windows:** Git Bash/MSYS2 performs automatic POSIX-to-Windows path conversion. Without `MSYS_NO_PATHCONV=1`, the Docker volume mount `/src` gets incorrectly converted to `C:/Program Files/Git/src`, causing Semgrep to fail with "Invalid scanning root" error.
180
+
181
+
DO NOT try the command without the prefix first on Windows - use the correct platform-specific command immediately.
182
+
183
+
**ESLint Security Plugin:**
184
+
- If `eslint-plugin-security` is detected in devDependencies, security rules are already included in the linting step
185
+
- No separate command needed, but note in discovery output that security linting is active
CRITICAL: Detect the platform from environment context and use the correct command automatically.
121
+
122
+
-**Windows (`win32`):** ALWAYS use `MSYS_NO_PATHCONV=1` prefix:
123
+
```bash
124
+
MSYS_NO_PATHCONV=1 docker run --rm -v "$(pwd):/src" semgrep/semgrep semgrep scan --config auto /src
125
+
```
126
+
-**macOS (`darwin`) / Linux:** Standard command:
127
+
```bash
128
+
docker run --rm -v "$(pwd):/src" semgrep/semgrep semgrep scan --config auto /src
129
+
```
130
+
131
+
**Why `MSYS_NO_PATHCONV=1` is required on Windows:** Git Bash/MSYS2 auto-converts POSIX paths to Windows paths. Without this prefix, `/src` becomes `C:/Program Files/Git/src`, causing "Invalid scanning root" error. DO NOT try without the prefix first on Windows.
132
+
94
133
## Discovery Strategy
95
134
96
135
### Step 1: Identify Project Type(s)
@@ -154,12 +193,22 @@ check: lint test
154
193
### Step 3: Detect CI Configuration
155
194
156
195
CheckforCIfilestoalignlocalcheckswithCI:
157
-
- `.github/workflows/*.yml` - GitHub Actions
196
+
- `.github/workflows/*.yml` - GitHub Actions (also check for semgrep jobs)
158
197
- `.gitlab-ci.yml` - GitLab CI
159
198
- `azure-pipelines.yml` - Azure DevOps
160
199
- `Jenkinsfile` - Jenkins
161
200
- `.circleci/config.yml` - CircleCI
162
201
202
+
### Step 4: Detect Security Tools
203
+
204
+
Checkforsecurityscanningconfiguration:
205
+
- `package.json` devDependencies for `eslint-plugin-security`
206
+
- `package.json` scripts containing `audit` or `semgrep`
0 commit comments