T

JonKazama-Hellion 00f5b89680 fix(ci): checkout via source archive instead of git fetch

git fetch over HTTPS is broken on this Gitea instance since 2026-08-12:
`git upload-pack --stateless-rpc` aborts with
BUG("packfile_uris requires sideband-all") in upload-pack.c and dumps
core on every fetch. Every checkout therefore failed before the scan
started, which is why all security runs have been red since then.

Reproduced against every repo, from multiple clients, on git 2.52 and
2.55, and on Gitea 1.26.1 as well as 1.26.4. SSH, the web UI and the
API are unaffected — only the smart-HTTP pack transfer dies.

Semgrep and Trivy operate on the working tree and do not need history,
so the sources are pulled as a tar archive over plain HTTP. This sidesteps
upload-pack entirely. Revert to actions/checkout once the fetch path is
fixed upstream.

2026-08-15 19:09:23 +02:00

.gitea/workflows

fix(ci): checkout via source archive instead of git fetch

2026-08-15 19:09:23 +02:00

README.md

Add semgrep-exclude-rules input, drop WARNING-severity-as-failing

2026-05-09 11:53:36 +02:00

renovate.json

Add renovate.json

2026-05-12 06:34:48 +00:00

README.md

security-workflows

Reusable Gitea Actions workflows for security scanning across Hellion repos. One central definition that all consumer repos call via a tiny stub.

Usage

In any consumer repo, add .gitea/workflows/security.yml:

name: Security
on:
  push:
    branches: [main, master]
  pull_request:
  schedule:
    - cron: '0 6 * * 1'   # weekly Monday 06:00 UTC
  workflow_dispatch:

jobs:
  scan:
    uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main

That is the entire stub. Five lines of jobs: plus the trigger config the consumer actually wants.

What runs

Tool	What it does
Semgrep (auto-config)	SAST scanning for common vulnerability patterns across C#, JavaScript, TypeScript, Python, Go and more. Pulls language-appropriate rule packs from semgrep.dev.
Trivy (filesystem scan)	Dependency vulnerability scanning against the NVD CVE database. Picks up NuGet `*.csproj`, npm `package.json`/`package-lock.json`, Dockerfiles and more.

Both jobs run in parallel. Either failing fails the calling workflow.

Tuning per consumer

The reusable workflow accepts three optional inputs:

jobs:
  scan:
    uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main
    with:
      severity: 'CRITICAL'                # default 'CRITICAL,HIGH'
      semgrep-config: 'p/owasp-top-ten'   # default 'auto'
      semgrep-exclude-rules: 'csharp.lang.security.sqli.csharp-sqli,javascript.express.security.audit.express-cookie'

Input	Default	What
`severity`	`CRITICAL,HIGH`	Trivy severity threshold for failing the build
`semgrep-config`	`auto`	Semgrep rule pack (e.g. `p/owasp-top-ten`, `p/javascript`, `p/csharp`)
`semgrep-exclude-rules`	`` (empty)	Comma-separated Semgrep rule IDs to skip in this repo. Useful for context-specific false positives, e.g. SQL-injection rules in a local-only plugin where the SQL strings come from code constants and the values are bound via SqlParameter.

Note that Semgrep is configured to fail the build only on ERROR-severity findings. WARNING-level rules still run for visibility but do not block, which keeps the noise floor low.

Pinning

Consumers reference @main for rolling updates. To pin a specific commit, use the SHA: @<sha>. There are no tagged releases yet, the workflow API is intentionally minimal so breaking changes should be rare.