Skip to content

Harden command execution in CI and tooling paths#16418

Merged
matthewp merged 4 commits intomainfrom
semgrep-ci-execution-hardening
Apr 22, 2026
Merged

Harden command execution in CI and tooling paths#16418
matthewp merged 4 commits intomainfrom
semgrep-ci-execution-hardening

Conversation

@matthewp
Copy link
Copy Markdown
Contributor

@matthewp matthewp commented Apr 20, 2026 •
edited
Loading

Changes

  • Stops the check-merge workflow from checking out forked PR code under pull_request_target by reading changed changesets through the GitHub API instead.
  • Replaces shell-based execution patterns in repo tooling and the sandbox image with explicit executables and a non-root container user.

Testing

  • Installed dependencies in a fresh worktree to validate the split branch in isolation.
  • Ran Biome against the touched workflow and script files to confirm the narrowed branch stays formatted and lint-clean.

Docs

  • No docs update needed, because this only hardens internal CI and tooling behavior.

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 20, 2026 •
edited
Loading

⚠️ No Changeset found

Latest commit: b4927c6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions github-actions Bot added the 🚨 action Modifies GitHub Actions label Apr 20, 2026
ematipico
ematipico approved these changes Apr 22, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@ematipico ematipico left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have no idea what the script does or works

@matthewp
fix(ci): restore shell spawn on Windows for turbo-run-affected
b4927c6 
The shell is required on Windows because turbo filter arguments contain
special characters (globs, brackets, etc.) that cause EINVAL errors
when passed directly to CreateProcess without a shell.
@matthewp matthewp merged commit 208b452 into main Apr 22, 2026
39 of 40 checks passed
@matthewp matthewp deleted the semgrep-ci-execution-hardening branch April 22, 2026 18:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ematipico ematipico ematipico approved these changes

Assignees

No one assigned

Labels

🚨 action Modifies GitHub Actions

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@matthewp @ematipico