bmottin/claude_mac
1
0
Fork 0
forked from bchanot/claude
Code Pull Requests Activity

feat(install): semgrep pinned install + pin-honored update (security-gate lot 1)

Browse Source 
Step 7.5 in install-plugins.sh: pipx install semgrep==<pin> behind a
command -v guard (LRN-085 pattern), version echo on skip, login is
Pro-rules-only guidance — never run automatically (ctx7 pattern).
Step 6.2 in update-all.sh: pin-honored update that displays the version
jump (cur → pin) before pipx install --force; latest only when unpinned.
plugins.lock.json: semgrep pinned 1.168.0 — semgrep is a BLOCKING gate,
a silent upgrade means new BLOCKs on unchanged code (gsd-pin pattern).

Dogfooded via extracted real blocks: fresh install, idempotent re-run,
pin-match skip, jump display + clean warn on bogus pin. Rulesets
p/security-audit + p/secrets fetch anonymously (no login) and detect.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpphkdTosUzokBDNG7PToS
This commit is contained in:
Bastien Chanot
2026-07-03 18:32:59 +02:00
co-authored by Claude Opus 4.8
parent ff13abfda5
commit ccfecc9c21
3 changed files with 76 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install-plugins.sh
+29
View File
@@ -654,6 +654,35 @@ if command -v graphify &>/dev/null; then
fi
echo ""
# ============================================================
# STEP 7.5 — SEMGREP (SAST engine for the security gate)
# ============================================================
echo "── Step 7.5: Semgrep — SAST security gate ───────────────────"
echo ""
if command -v semgrep &>/dev/null; then
ok "semgrep already installed ($(semgrep --version 2>/dev/null | head -1))"
else
SEMGREP_VER=$(pinned_version "semgrep")
if [ "$SEMGREP_VER" != "latest" ]; then
info "Installing semgrep ${SEMGREP_VER} (pinned in plugins.lock.json)..."
pipx install "semgrep==${SEMGREP_VER}" 2>/dev/null
else
info "Installing semgrep latest (consider pinning in plugins.lock.json)..."
pipx install semgrep 2>/dev/null
fi
if command -v semgrep &>/dev/null; then
ok "semgrep installed ($(semgrep --version 2>/dev/null | head -1))"
else
err "semgrep install failed — run manually: pipx install semgrep"
fi
fi
# Login is Pro-rules only and optional — NEVER run automatically (ctx7
# pattern: guide, don't block). The gate uses pinned public rulesets.
if command -v semgrep &>/dev/null; then
info "Optional Pro rules: semgrep login (never run automatically)"
fi
echo ""
# ============================================================
# STEP 8 — EMIL DESIGN ENG (UI polish / animation skill)
# ============================================================