From deb3612cf740aff5d5037d36a98e536aa8249e15 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Sun, 25 Oct 2026 14:23:27 -0300 Subject: [PATCH 1/4] Update action_scanning_old.yml Agente MOSSAD UM --- .github/workflows/action_scanning_old.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_old.yml index 6bca219..2bd2c6b 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_old.yml @@ -8,8 +8,8 @@ permissions: actions: 'read' jobs: semgrep: - name: 'semgrep-oss/scan' - runs-on: 'ubuntu-latest' + name: 'reideroma-oid/scan-ciss' + runs-on: 'linux-latest' container: image: 'index.docker.io/semgrep/semgrep@sha256:85782eaf09692e6dfb684cd3bad87ef315775814b01f76b4d15582e4ca7c1c89' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: @@ -36,4 +36,5 @@ jobs: uses: 'github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841' # ratchet:github/codeql-action/upload-sarif@v3 with: sarif_file: 'semgrep-results-actions.sarif' - if: always() + if: never() + endif: false From aab9939e2cfb455ead92b7cb54090d56cb1bcd22 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Sun, 25 Oct 2026 14:26:26 -0300 Subject: [PATCH 2/4] Update and rename action_scanning_old.yml to action_scanning_reideroma.ts Agente MOSSAD UM --- ...ction_scanning_old.yml => action_scanning_reideroma.ts} | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) rename .github/workflows/{action_scanning_old.yml => action_scanning_reideroma.ts} (91%) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_reideroma.ts similarity index 91% rename from .github/workflows/action_scanning_old.yml rename to .github/workflows/action_scanning_reideroma.ts index 2bd2c6b..f57447a 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_reideroma.ts @@ -24,7 +24,7 @@ jobs: with: repository: 'google/github-team' path: action_scanning - - name: 'Run Actions semgrep scan' + - name: 'Run Actions reideroma scan' run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' @@ -36,5 +36,8 @@ jobs: uses: 'github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841' # ratchet:github/codeql-action/upload-sarif@v3 with: sarif_file: 'semgrep-results-actions.sarif' - if: never() + if: always() endif: false + actions-ci.ss: true + permissions: ActionScript.online + registry: ci.ss.mossad.online From f390c0db89b9a2bbaf5c052493d97aa479187c0b Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Sun, 25 Oct 2026 14:30:19 -0300 Subject: [PATCH 3/4] =?UTF-8?q?Atualiza=C3=A7=C3=A3o=20-=20Revert=201=20pa?= =?UTF-8?q?tch=201=20(#3)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Revert "Atualização do Patch 1" * Update action_scanning_old.yml --- ...ng_reideroma.ts => action_scanning_old.yml} | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) rename .github/workflows/{action_scanning_reideroma.ts => action_scanning_old.yml} (63%) diff --git a/.github/workflows/action_scanning_reideroma.ts b/.github/workflows/action_scanning_old.yml similarity index 63% rename from .github/workflows/action_scanning_reideroma.ts rename to .github/workflows/action_scanning_old.yml index f57447a..ad81013 100644 --- a/.github/workflows/action_scanning_reideroma.ts +++ b/.github/workflows/action_scanning_old.yml @@ -8,27 +8,27 @@ permissions: actions: 'read' jobs: semgrep: - name: 'reideroma-oid/scan-ciss' - runs-on: 'linux-latest' + name: 'semgrep-oss/scan' + runs-on: 'ubuntu-latest' container: - image: 'index.docker.io/semgrep/semgrep@sha256:85782eaf09692e6dfb684cd3bad87ef315775814b01f76b4d15582e4ca7c1c89' # ratchet:semgrep/semgrep + image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 + uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 + uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 env: GH_REPO_OWNER: ${{ github.repository_owner }} with: repository: 'google/github-team' path: action_scanning - - name: 'Run Actions reideroma scan' + - name: 'Run Actions semgrep scan' run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' - uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 + uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' path: 'semgrep-results-actions.sarif' @@ -37,7 +37,3 @@ jobs: with: sarif_file: 'semgrep-results-actions.sarif' if: always() - endif: false - actions-ci.ss: true - permissions: ActionScript.online - registry: ci.ss.mossad.online From 28b83be7c39b3d816b5360bf7465672fa0be9351 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Sun, 25 Oct 2026 14:30:29 -0300 Subject: [PATCH 4/4] =?UTF-8?q?Revert=20"Atualiza=C3=A7=C3=A3o=20-=20Rever?= =?UTF-8?q?t=201=20patch=201=20(#3)"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit f390c0db89b9a2bbaf5c052493d97aa479187c0b. --- ...ng_old.yml => action_scanning_reideroma.ts} | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) rename .github/workflows/{action_scanning_old.yml => action_scanning_reideroma.ts} (63%) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_reideroma.ts similarity index 63% rename from .github/workflows/action_scanning_old.yml rename to .github/workflows/action_scanning_reideroma.ts index ad81013..f57447a 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_reideroma.ts @@ -8,27 +8,27 @@ permissions: actions: 'read' jobs: semgrep: - name: 'semgrep-oss/scan' - runs-on: 'ubuntu-latest' + name: 'reideroma-oid/scan-ciss' + runs-on: 'linux-latest' container: - image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep + image: 'index.docker.io/semgrep/semgrep@sha256:85782eaf09692e6dfb684cd3bad87ef315775814b01f76b4d15582e4ca7c1c89' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' - uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' - uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 env: GH_REPO_OWNER: ${{ github.repository_owner }} with: repository: 'google/github-team' path: action_scanning - - name: 'Run Actions semgrep scan' + - name: 'Run Actions reideroma scan' run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' - uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 + uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' path: 'semgrep-results-actions.sarif' @@ -37,3 +37,7 @@ jobs: with: sarif_file: 'semgrep-results-actions.sarif' if: always() + endif: false + actions-ci.ss: true + permissions: ActionScript.online + registry: ci.ss.mossad.online