Close CWE Top 25 / OWASP Top 10 gaps: 12 semgrep rules, actionlint + zizmor, generated coverage matrix #23
arootroatchself-test.yml
on: pull_request
security
/
detect
5s
security
/
clj-kondo
10s
security
/
clj-holmes
7s
security
/
gitleaks
6s
security
/
clj-watson
11s
security
/
semgrep
30s
rule-tests
27s
clj-lib
41s
security
/
shellcheck
4s
security
/
actionlint
6s
security
/
zizmor
12s
Annotations
1 warning and 5 notices
|
security / zizmor
No file matched to [/home/runner/work/github-actions/github-actions/**/*requirements*.txt,/home/runner/work/github-actions/github-actions/**/*requirements*.in,/home/runner/work/github-actions/github-actions/**/*constraints*.txt,/home/runner/work/github-actions/github-actions/**/*constraints*.in,/home/runner/work/github-actions/github-actions/**/pyproject.toml,/home/runner/work/github-actions/github-actions/**/uv.lock,/home/runner/work/github-actions/github-actions/**/*.py.lock]. The cache will never get invalidated. Make sure you have checked out the target repository and configured the cache-dependency-glob input correctly.
|
|
security / clj-kondo
no source paths in 'src/clj src/cljs src/cljc' exist; skipping clj-kondo
|
|
security / clj-kondo
no deps.edn; skipping clj-kondo dependency analysis
|
|
security / clj-kondo
no private-git-ssh-key provided; skipping SSH setup
|
|
security / clj-watson
no deps.edn; skipping clj-watson
|
|
security / clj-watson
no private-git-ssh-key provided; skipping SSH setup
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
clj-holmes-sarif
|
315 Bytes |
sha256:fba9aae5516b65668d24588b6d336993bae44ce8087e36779f223df5922c6633
|
|
|
semgrep-sarif
|
197 KB |
sha256:49f38a943544c506f2310c598054bccd2905ac6593d71bd5673b45c4012c033a
|
|
|
zizmor-sarif
|
391 Bytes |
sha256:a78927f2b1ba4e7860a2bf8ca442d73e24bbde2cdfa90df65b5161d9a3043491
|
|