ci: add Semgrep OSS scanning workflow#1376
Merged
Merged
Conversation
🦋 Changeset detectedLatest commit: fdd982c The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
whoiskatrin
force-pushed
the
hrushikesh/add-semgrep-oss-workflow
branch
from
517bd09 to
7c9fa07
Compare
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
agents
@cloudflare/ai-chat
@cloudflare/codemode
hono-agents
@cloudflare/shell
@cloudflare/think
@cloudflare/voice
@cloudflare/worker-bundler
commit: |
Address Devin Review feedback: - packages/agents/src/chat/resumable-stream.ts: wrap remaining bare connection.send() calls in replayChunks with sendIfOpen so a WebSocket closing mid-replay no longer throws. - .github/workflows/semgrep.yml: switch the schedule to '0 0 * * 6' and add a gate job that filters scheduled runs to the first Saturday of each month, avoiding POSIX cron's day-of-month / day-of-week OR semantics.
Merged
2 tasks
whoiskatrin
added a commit
that referenced
this pull request
May 5, 2026
Mirror the sendIfOpen pattern that ai-chat already uses for the stream-resume ACK fallback. Without this, when the WebSocket closes during ResumableStream.replayCompletedChunksByRequestId the method now returns false (since #1376), and the fallback bare connection.send() in _handleStreamResumeAck throws TypeError: WebSocket send() after close up through onMessage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Semgrep Community Edition (OSS) scanning to this repository as part of the App&ProdSec team's migration from Semgrep Pro to Semgrep CE, plus a fix for the closed-WebSocket replay race in
agents/chat.Semgrep workflow
pushto the main/master branch, and on the first Saturday of each month.actions/cache@v5sopip install semgreponly runs on cold cache (first run, version bump, or 7-day idle).semgrep==1.160.0with--config=auto(default OSS ruleset).ubuntu-slimwithcontents: readtoken scope.gatejob filters scheduled runs to the first 7 days of the month so the schedule means "first Saturday only" without relying on POSIX cron's day-of-month / day-of-week OR semantics.Closed-WebSocket replay race (
agents/chat)ResumableStream.replayChunksandreplayCompletedChunksByRequestIdroute everyconnection.send()through asendIfOpenhelper that swallows theTypeError: WebSocket send() after closerace and reports failure to the caller.@cloudflare/ai-chat's stream-resume ACK handler also goes throughsendIfOpen.replayChunks, the stream is left active so the next reconnect can retry from the start. The orphan-cleanup branch still callscomplete()and returns the stream id even if the finaldonesend misses, so the caller persists the reconstructed message regardless of whether this particular socket received the frame.Review & Testing Checklist for Human
gatejob +0 0 * * 6cron is acceptable for the App&ProdSec team's "monthly, staggered" intent (vs. accepting the original ~10x/month POSIX-OR schedule).workflow_dispatchonmainafter merge produces a Semgrep findings summary as expected.@cloudflare/think's_handleStreamResumeAckfallback should mirror thesendIfOpenchange here in a follow-up PR — Devin Review flagged the same pattern inpackages/think/src/think.ts:2601, but the original author marked thethink.tspath as out of this PR's scope.Notes
actions/checkout@v6for consistency, gated the cron schedule, and wrapped the remaining bareconnection.send()calls inreplayChunks.@cloudflare/thinkconsumer ofreplayCompletedChunksByRequestIdstill uses a bareconnection.send()and was intentionally left out of scope here.Link to Devin session: https://app.devin.ai/sessions/303193c332f24e08b4c8525adb58e285
Requested by: @whoiskatrin