sast.yml

name: SAST

# CI-002 (#1171): static analysis for SQL injection (raw string SQL),
# unsafe unwrap/expect in production gateway code, and unredacted secret
# logging, on top of community Rust/Python security rulesets. Blocking:
# any finding fails the job (default semgrep exit code 1 on findings).

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  semgrep:
    name: Semgrep SAST
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep
    steps:
      - uses: actions/checkout@v7
      - name: Run semgrep (custom rules + Rust/Python security rulesets)
        # The community blanket unsafe-usage rule is replaced by the
        # path-scoped rust-unsafe-outside-reviewed-crates rule in
        # .semgrep/aegisagent-rust.yml: `lib/event` carries isolated,
        # SAFETY-documented unsafe under ADR-0006..0009 with its own Miri,
        # Loom, ASan and TSan CI lanes; everywhere else unsafe still blocks.
        run: |
          semgrep scan \
            --config .semgrep/ \
            --config p/rust \
            --config p/python \
            --config p/secrets \
            --exclude-rule rust.lang.security.unsafe-usage.unsafe-usage \
            --error