chore: skip test data and dev-only files in the OpenGrep scan
Merged
JI
2d ago+56+56+01234567890123456789-9-9-0123456789
Stop false positives in the managed OpenGrep SAST scan. The scan reported test keys, sample reports with fake tokens, the development keys and Dex users, vendored chart documentation, and exec calls whose input does not come from users.
- Add a
.semgrepignorefor test data,devel/and the README files of the vendored Bitnami charts. The file replaces the default ignore list of OpenGrep, so it repeats that list first. - Mark the remaining false positives with
nosemgrep: the development CAS key and the Dex users of the Helm chart (used only whendevelopment: true), the plugin loader in the control plane, and the e2e harness of the CLI trace. - Bump the chart patch version. The rendered chart does not change.
The 9 curl | sh installs in the GitHub workflows still show. They are real findings, and a separate change will fix them.
Refs PFM-8051.
AI disclosure: Claude Code helped to triage the findings and to write this change.