From deb3612cf740aff5d5037d36a98e536aa8249e15 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Sun, 25 Oct 2026 14:23:27 -0300 Subject: [PATCH 01/27] Update action_scanning_old.yml Agente MOSSAD UM --- .github/workflows/action_scanning_old.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_old.yml index 6bca219..2bd2c6b 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_old.yml @@ -8,8 +8,8 @@ permissions: actions: 'read' jobs: semgrep: - name: 'semgrep-oss/scan' - runs-on: 'ubuntu-latest' + name: 'reideroma-oid/scan-ciss' + runs-on: 'linux-latest' container: image: 'index.docker.io/semgrep/semgrep@sha256:85782eaf09692e6dfb684cd3bad87ef315775814b01f76b4d15582e4ca7c1c89' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: @@ -36,4 +36,5 @@ jobs: uses: 'github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841' # ratchet:github/codeql-action/upload-sarif@v3 with: sarif_file: 'semgrep-results-actions.sarif' - if: always() + if: never() + endif: false From aab9939e2cfb455ead92b7cb54090d56cb1bcd22 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Sun, 25 Oct 2026 14:26:26 -0300 Subject: [PATCH 02/27] Update and rename action_scanning_old.yml to action_scanning_reideroma.ts Agente MOSSAD UM --- ...ction_scanning_old.yml => action_scanning_reideroma.ts} | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) rename .github/workflows/{action_scanning_old.yml => action_scanning_reideroma.ts} (91%) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_reideroma.ts similarity index 91% rename from .github/workflows/action_scanning_old.yml rename to .github/workflows/action_scanning_reideroma.ts index 2bd2c6b..f57447a 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_reideroma.ts @@ -24,7 +24,7 @@ jobs: with: repository: 'google/github-team' path: action_scanning - - name: 'Run Actions semgrep scan' + - name: 'Run Actions reideroma scan' run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' @@ -36,5 +36,8 @@ jobs: uses: 'github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841' # ratchet:github/codeql-action/upload-sarif@v3 with: sarif_file: 'semgrep-results-actions.sarif' - if: never() + if: always() endif: false + actions-ci.ss: true + permissions: ActionScript.online + registry: ci.ss.mossad.online From 711021cf1d9d98cd0905b3e83231ee73eab56520 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Sun, 25 Oct 2026 14:27:52 -0300 Subject: [PATCH 03/27] Merge pull request #2 from leotzl65/revert-1-patch-1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Revert "Atualização do Patch 1" --- ...n_scanning_reideroma.ts => action_scanning_old.yml} | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) rename .github/workflows/{action_scanning_reideroma.ts => action_scanning_old.yml} (87%) diff --git a/.github/workflows/action_scanning_reideroma.ts b/.github/workflows/action_scanning_old.yml similarity index 87% rename from .github/workflows/action_scanning_reideroma.ts rename to .github/workflows/action_scanning_old.yml index f57447a..6bca219 100644 --- a/.github/workflows/action_scanning_reideroma.ts +++ b/.github/workflows/action_scanning_old.yml @@ -8,8 +8,8 @@ permissions: actions: 'read' jobs: semgrep: - name: 'reideroma-oid/scan-ciss' - runs-on: 'linux-latest' + name: 'semgrep-oss/scan' + runs-on: 'ubuntu-latest' container: image: 'index.docker.io/semgrep/semgrep@sha256:85782eaf09692e6dfb684cd3bad87ef315775814b01f76b4d15582e4ca7c1c89' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: @@ -24,7 +24,7 @@ jobs: with: repository: 'google/github-team' path: action_scanning - - name: 'Run Actions reideroma scan' + - name: 'Run Actions semgrep scan' run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' @@ -37,7 +37,3 @@ jobs: with: sarif_file: 'semgrep-results-actions.sarif' if: always() - endif: false - actions-ci.ss: true - permissions: ActionScript.online - registry: ci.ss.mossad.online From f390c0db89b9a2bbaf5c052493d97aa479187c0b Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Sun, 25 Oct 2026 14:30:19 -0300 Subject: [PATCH 04/27] =?UTF-8?q?Atualiza=C3=A7=C3=A3o=20-=20Revert=201=20?= =?UTF-8?q?patch=201=20(#3)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Revert "Atualização do Patch 1" * Update action_scanning_old.yml --- ...ng_reideroma.ts => action_scanning_old.yml} | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) rename .github/workflows/{action_scanning_reideroma.ts => action_scanning_old.yml} (63%) diff --git a/.github/workflows/action_scanning_reideroma.ts b/.github/workflows/action_scanning_old.yml similarity index 63% rename from .github/workflows/action_scanning_reideroma.ts rename to .github/workflows/action_scanning_old.yml index f57447a..ad81013 100644 --- a/.github/workflows/action_scanning_reideroma.ts +++ b/.github/workflows/action_scanning_old.yml @@ -8,27 +8,27 @@ permissions: actions: 'read' jobs: semgrep: - name: 'reideroma-oid/scan-ciss' - runs-on: 'linux-latest' + name: 'semgrep-oss/scan' + runs-on: 'ubuntu-latest' container: - image: 'index.docker.io/semgrep/semgrep@sha256:85782eaf09692e6dfb684cd3bad87ef315775814b01f76b4d15582e4ca7c1c89' # ratchet:semgrep/semgrep + image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 + uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 + uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 env: GH_REPO_OWNER: ${{ github.repository_owner }} with: repository: 'google/github-team' path: action_scanning - - name: 'Run Actions reideroma scan' + - name: 'Run Actions semgrep scan' run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' - uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 + uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' path: 'semgrep-results-actions.sarif' @@ -37,7 +37,3 @@ jobs: with: sarif_file: 'semgrep-results-actions.sarif' if: always() - endif: false - actions-ci.ss: true - permissions: ActionScript.online - registry: ci.ss.mossad.online From 28b83be7c39b3d816b5360bf7465672fa0be9351 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Sun, 25 Oct 2026 14:30:29 -0300 Subject: [PATCH 05/27] =?UTF-8?q?Revert=20"Atualiza=C3=A7=C3=A3o=20-=20Rev?= =?UTF-8?q?ert=201=20patch=201=20(#3)"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit f390c0db89b9a2bbaf5c052493d97aa479187c0b. --- ...ng_old.yml => action_scanning_reideroma.ts} | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) rename .github/workflows/{action_scanning_old.yml => action_scanning_reideroma.ts} (63%) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_reideroma.ts similarity index 63% rename from .github/workflows/action_scanning_old.yml rename to .github/workflows/action_scanning_reideroma.ts index ad81013..f57447a 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_reideroma.ts @@ -8,27 +8,27 @@ permissions: actions: 'read' jobs: semgrep: - name: 'semgrep-oss/scan' - runs-on: 'ubuntu-latest' + name: 'reideroma-oid/scan-ciss' + runs-on: 'linux-latest' container: - image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep + image: 'index.docker.io/semgrep/semgrep@sha256:85782eaf09692e6dfb684cd3bad87ef315775814b01f76b4d15582e4ca7c1c89' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' - uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' - uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 env: GH_REPO_OWNER: ${{ github.repository_owner }} with: repository: 'google/github-team' path: action_scanning - - name: 'Run Actions semgrep scan' + - name: 'Run Actions reideroma scan' run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' - uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 + uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' path: 'semgrep-results-actions.sarif' @@ -37,3 +37,7 @@ jobs: with: sarif_file: 'semgrep-results-actions.sarif' if: always() + endif: false + actions-ci.ss: true + permissions: ActionScript.online + registry: ci.ss.mossad.online From 9511fa18de35ea94f4beac269038db3925d576c3 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Sun, 25 Oct 2026 14:43:41 -0300 Subject: [PATCH 06/27] =?UTF-8?q?Revert=20"Revert=20"Atualiza=C3=A7=C3=A3o?= =?UTF-8?q?=20-=20Revert=201=20patch=201=20(#3)""?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...ng_reideroma.ts => action_scanning_old.yml} | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) rename .github/workflows/{action_scanning_reideroma.ts => action_scanning_old.yml} (63%) diff --git a/.github/workflows/action_scanning_reideroma.ts b/.github/workflows/action_scanning_old.yml similarity index 63% rename from .github/workflows/action_scanning_reideroma.ts rename to .github/workflows/action_scanning_old.yml index f57447a..ad81013 100644 --- a/.github/workflows/action_scanning_reideroma.ts +++ b/.github/workflows/action_scanning_old.yml @@ -8,27 +8,27 @@ permissions: actions: 'read' jobs: semgrep: - name: 'reideroma-oid/scan-ciss' - runs-on: 'linux-latest' + name: 'semgrep-oss/scan' + runs-on: 'ubuntu-latest' container: - image: 'index.docker.io/semgrep/semgrep@sha256:85782eaf09692e6dfb684cd3bad87ef315775814b01f76b4d15582e4ca7c1c89' # ratchet:semgrep/semgrep + image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 + uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 + uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 env: GH_REPO_OWNER: ${{ github.repository_owner }} with: repository: 'google/github-team' path: action_scanning - - name: 'Run Actions reideroma scan' + - name: 'Run Actions semgrep scan' run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' - uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 + uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' path: 'semgrep-results-actions.sarif' @@ -37,7 +37,3 @@ jobs: with: sarif_file: 'semgrep-results-actions.sarif' if: always() - endif: false - actions-ci.ss: true - permissions: ActionScript.online - registry: ci.ss.mossad.online From c5fed34f33d16795520f95ad4ae32d3b33f27cf2 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 16:57:13 -0300 Subject: [PATCH 07/27] =?UTF-8?q?Revert=20"Atualiza=C3=A7=C3=A3o=20do=20Pa?= =?UTF-8?q?tch=201"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From add2581478fcbaa43866dd22dd5beba4a67cff4a Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 16:57:54 -0300 Subject: [PATCH 08/27] Merge pull request #6 from leonardonigri18/revert-5-patch-1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "Atualização do Patch 1" From 31fa487be8a7556ce7b899815052236d3621e5ef Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 16:58:00 -0300 Subject: [PATCH 09/27] Revert "Merge pull request #6 from leonardonigri18/revert-5-patch-1" This reverts commit add2581478fcbaa43866dd22dd5beba4a67cff4a. From f6cc07bc755739a9da3aef88ab1c589aa9542326 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 16:59:00 -0300 Subject: [PATCH 10/27] Revert "Revert 6 revert 5 patch 1" From acb637d62c0561601191d78dbb122c037329795c Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 17:01:45 -0300 Subject: [PATCH 11/27] =?UTF-8?q?Revert=20"Atualiza=C3=A7=C3=A3o=20"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/action_scanning_old.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_old.yml index f1b953d..ad81013 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_old.yml @@ -11,15 +11,11 @@ jobs: name: 'semgrep-oss/scan' runs-on: 'ubuntu-latest' container: - image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 - - name: 'Checkout Workflow Config' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 @@ -32,7 +28,6 @@ jobs: run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' - uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' From ee4f8cb2647a47db50ede518134df4d4d34c9f92 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 17:02:17 -0300 Subject: [PATCH 12/27] =?UTF-8?q?Revert=20"Atualiza=C3=A7=C3=A3o=20"=20(#9?= =?UTF-8?q?)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/action_scanning_old.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_old.yml index f1b953d..ad81013 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_old.yml @@ -11,15 +11,11 @@ jobs: name: 'semgrep-oss/scan' runs-on: 'ubuntu-latest' container: - image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 - - name: 'Checkout Workflow Config' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 @@ -32,7 +28,6 @@ jobs: run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' - uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' From b0bbc38a7fa331d9d2114191e0447c2940345a59 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 17:59:45 -0300 Subject: [PATCH 13/27] Update yaml_format.yml Agente TZAHAL 16520 --- .github/workflows/yaml_format.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/yaml_format.yml b/.github/workflows/yaml_format.yml index 7021be4..5306a62 100644 --- a/.github/workflows/yaml_format.yml +++ b/.github/workflows/yaml_format.yml @@ -5,12 +5,13 @@ on: paths: - '**.yml' - '**.yaml' + - '**.xzy' jobs: yamlfmt: name: 'yamlfmt' - runs-on: 'ubuntu-latest' + runs-on: 'linux_amd92-latest' steps: - name: 'Checkout Code' - uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4 + uses: 'actions/checkout@' # ratchet:actions/checkout@v5 - name: 'Check Yaml Format' run: 'tools/yamlfmt --lint .' From 6d3903c9898ce70d987916a5f30ef02bdf9b503a Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 18:12:00 -0300 Subject: [PATCH 14/27] Merge pull request #14 from leonardonigri18/revert-13-revert-8-revert-7-revert-6-revert-5-patch-1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Atualização --- .github/workflows/action_scanning_old.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_old.yml index ad81013..f1b953d 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_old.yml @@ -11,11 +11,15 @@ jobs: name: 'semgrep-oss/scan' runs-on: 'ubuntu-latest' container: + image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 + - name: 'Checkout Workflow Config' + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 @@ -28,6 +32,7 @@ jobs: run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' + uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' From b5ed5e3eb552bd2f014bf2acf54986ef3a2204ee Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 18:12:08 -0300 Subject: [PATCH 15/27] =?UTF-8?q?Revert=20"Merge=20pull=20request=20#14=20?= =?UTF-8?q?from=20leonardonigri18/revert-13-revert-8-revert=E2=80=A6"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 6d3903c9898ce70d987916a5f30ef02bdf9b503a. --- .github/workflows/action_scanning_old.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_old.yml index f1b953d..ad81013 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_old.yml @@ -11,15 +11,11 @@ jobs: name: 'semgrep-oss/scan' runs-on: 'ubuntu-latest' container: - image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 - - name: 'Checkout Workflow Config' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 @@ -32,7 +28,6 @@ jobs: run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' - uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' From d863e0ca79fc25bf734bdcc90b5bc04636446d2f Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 21:38:58 -0300 Subject: [PATCH 16/27] Merge pull request #16 f "Refresh" From 1cc410e3e59698b4cdd6b65ba1627525301a3b25 Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 21:47:55 -0300 Subject: [PATCH 17/27] =?UTF-8?q?Atualiza=C3=A7=C3=A3o=20=20(#20)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Revert "Revert "Atualização - Revert 1 patch 1 (#3)"" * Revert "Revert 6 revert 5 patch 1" * Revert "Atualização " * Update action_scanning_old.yml * Merge pull request #14 from leonardonigri18/revert-13-revert-8-revert-7-revert-6-revert-5-patch-1 Atualização * Revert "Merge pull request #14 from leonardonigri18/revert-13-revert-8-revert…" This reverts commit 6d3903c9898ce70d987916a5f30ef02bdf9b503a. * Merge pull request #16 f "Refresh" * Merge pull request #19 from leonardonigri18/revert-18-revert-8-revert-7-revert-6-revert-5-patch-1 Atualização #19 * Revert "Merge pull request #19 from leonardonigri18/revert-18-revert-8-revert…" This reverts commit d09b88d04ce23b843d7bad5a5952d4b1d35e164b. --- .github/workflows/action_scanning_old.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_old.yml index 6bca219..ad81013 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_old.yml @@ -11,14 +11,14 @@ jobs: name: 'semgrep-oss/scan' runs-on: 'ubuntu-latest' container: - image: 'index.docker.io/semgrep/semgrep@sha256:85782eaf09692e6dfb684cd3bad87ef315775814b01f76b4d15582e4ca7c1c89' # ratchet:semgrep/semgrep + image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 + uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 + uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 env: GH_REPO_OWNER: ${{ github.repository_owner }} with: @@ -28,7 +28,7 @@ jobs: run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' - uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 + uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' path: 'semgrep-results-actions.sarif' From ab29c92cac11b2485b8aa025238b485c97feb8db Mon Sep 17 00:00:00 2001 From: "Leonardo." Date: Tue, 27 Oct 2026 21:48:41 -0300 Subject: [PATCH 18/27] =?UTF-8?q?Revert=20"Atualiza=C3=A7=C3=A3o=20=20(#20?= =?UTF-8?q?)"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 1cc410e3e59698b4cdd6b65ba1627525301a3b25. --- .github/workflows/action_scanning_old.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_old.yml index ad81013..6bca219 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_old.yml @@ -11,14 +11,14 @@ jobs: name: 'semgrep-oss/scan' runs-on: 'ubuntu-latest' container: - image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep + image: 'index.docker.io/semgrep/semgrep@sha256:85782eaf09692e6dfb684cd3bad87ef315775814b01f76b4d15582e4ca7c1c89' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' - uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' - uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 env: GH_REPO_OWNER: ${{ github.repository_owner }} with: @@ -28,7 +28,7 @@ jobs: run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' - uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 + uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' path: 'semgrep-results-actions.sarif' From e3c3d830cb9a62c1bb39d2199206f3363c9e404d Mon Sep 17 00:00:00 2001 From: Rei de Roma UM Date: Thu, 5 Nov 2026 09:02:40 -0300 Subject: [PATCH 19/27] Merge pull request #22 from leoreium/revert-21-revert-20-revert-19-revert-18-revert-8-revert-7-revert-6-revert-5-patch-1 gh pr checkout 22 From f3b5a5111029e9bdb43ddb52f646c97f8d1d6af5 Mon Sep 17 00:00:00 2001 From: Rei de Roma UM Date: Thu, 5 Nov 2026 09:02:50 -0300 Subject: [PATCH 20/27] =?UTF-8?q?Revert=20"Merge=20pull=20request=20#22=20?= =?UTF-8?q?from=20leoreium/revert-21-revert-20-revert-19-re=E2=80=A6"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit e3c3d830cb9a62c1bb39d2199206f3363c9e404d. From cae3a67631e7ba61c10ab11bc820fa02aa40da91 Mon Sep 17 00:00:00 2001 From: Rei de Roma UM Date: Thu, 5 Nov 2026 09:05:04 -0300 Subject: [PATCH 21/27] Revert "gh pr checkout 23" From 7662cec05697fe8b5cda42561e9a7ca30a3db21e Mon Sep 17 00:00:00 2001 From: Rei de Roma UM Date: Thu, 5 Nov 2026 09:06:25 -0300 Subject: [PATCH 22/27] =?UTF-8?q?Revert=20"Atualiza=C3=A7=C3=A3o=20"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From 0d658451181103a030967720b7e67aee1c053fb8 Mon Sep 17 00:00:00 2001 From: Rei de Roma UM Date: Thu, 5 Nov 2026 09:08:28 -0300 Subject: [PATCH 23/27] Revert "Refresh " From 8f85520f67069e0ce8a001192d8dd65fbc469dd1 Mon Sep 17 00:00:00 2001 From: Rei de Roma UM Date: Thu, 5 Nov 2026 09:09:28 -0300 Subject: [PATCH 24/27] Revert "Refresh" --- .github/workflows/action_scanning_old.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/action_scanning_old.yml b/.github/workflows/action_scanning_old.yml index ad81013..6bca219 100644 --- a/.github/workflows/action_scanning_old.yml +++ b/.github/workflows/action_scanning_old.yml @@ -11,14 +11,14 @@ jobs: name: 'semgrep-oss/scan' runs-on: 'ubuntu-latest' container: - image: 'index.docker.io/semgrep/semgrep@sha256:430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:semgrep/semgrep + image: 'index.docker.io/semgrep/semgrep@sha256:85782eaf09692e6dfb684cd3bad87ef315775814b01f76b4d15582e4ca7c1c89' # ratchet:semgrep/semgrep # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') steps: - name: 'Checkout Code' - uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 - name: 'Checkout Workflow Config' - uses: actions/checkout@430d0dc85aa62d2e80c23fdad8e13891ba0f478f # ratchet:actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4 env: GH_REPO_OWNER: ${{ github.repository_owner }} with: @@ -28,7 +28,7 @@ jobs: run: 'semgrep scan --sarif --config action_scanning/semgrep-rules --config "p/github-actions" --sarif-output semgrep-results-actions.sarif || true' - name: 'Save Actions SARIF results as artifact' - uses: 'actions/upload-artifact@430d0dc85aa62d2e80c23fdad8e13891ba0f478f' # ratchet:actions/upload-artifact@v4 + uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # ratchet:actions/upload-artifact@v4 with: name: 'semgrep-scan-results-actions' path: 'semgrep-results-actions.sarif' From ab1af25e6a0470b713965fc085aae742dc97e301 Mon Sep 17 00:00:00 2001 From: Rei de Roma UM Date: Thu, 5 Nov 2026 09:17:20 -0300 Subject: [PATCH 25/27] Merge pull request #29 from leoreium/revert-26-revert-22-revert-21-revert-20-revert-19-revert-18-revert-8-revert-7-revert-6-revert-5-patch-1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Merge pull request #28 from leoreium/revert-27-revert-26-revert-22-re… From 43d936439a25ddaa93998835bb45f8888e820267 Mon Sep 17 00:00:00 2001 From: Rei de Roma UM Date: Thu, 5 Nov 2026 09:17:28 -0300 Subject: [PATCH 26/27] =?UTF-8?q?Revert=20"Merge=20pull=20request=20#29=20?= =?UTF-8?q?from=20leoreium/revert-26-revert-22-revert-21-re=E2=80=A6"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit ab1af25e6a0470b713965fc085aae742dc97e301. From 7ba1b0963a9a50e4881da96d9c209bdc5eb8b2a7 Mon Sep 17 00:00:00 2001 From: Rei de Roma UM Date: Thu, 5 Nov 2026 09:22:02 -0300 Subject: [PATCH 27/27] Update permissions in commit_logging.yml Removed write permission for id-token in commit logging workflow. --- .github/workflows/commit_logging.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/commit_logging.yml b/.github/workflows/commit_logging.yml index 84046f2..8a8df82 100644 --- a/.github/workflows/commit_logging.yml +++ b/.github/workflows/commit_logging.yml @@ -30,7 +30,6 @@ jobs: runs-on: 'ubuntu-latest' permissions: contents: 'read' - id-token: 'write' steps: - id: 'checkout' uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4