chore: skip test data and dev-only files in the OpenGrep scan

.semgrepignore

@@ -0,0 +1,47 @@
+# Paths that the OpenGrep SAST scan skips. The managed sast-scan workflow runs
+# OpenGrep from the repository root, which reads this file.
+#
+# This file replaces the default ignore list of OpenGrep, so the first block
+# repeats those defaults (OpenGrep 1.12.0, src/targeting/Semgrepignore.ml).
+
+# Administrative folder or file used by popular version control systems
+.git
+.svn
+.hg
+_darcs
+CVS
+
+# Paths to files and folders that are typically large and ignorable
+build/
+vendor/
+dist/
+*.min.js
+.env/
+.tox/
+
+# Package managers
+node_modules/
+.npm/
+.yarn/
+.venv/
+_opam/
+_build/
+_cargo/
+
+# Common test paths
+test/
+tests/
+testsuite/
+*_test.go
+
+# End of the OpenGrep defaults.
+
+# Test data: test keys, sample reports with fake tokens, and test fixtures.
+testdata/
+
+# Development-only setup: development keys, Dex users and docs with example
+# tokens. None of it is shipped.
+devel/
+
+# Documentation of the vendored Bitnami charts, also of nested chart dependencies.
+deployment/chainloop/charts/**/README.md

app/cli/internal/trace/e2e/claude.go

@@ -54,7 +54,7 @@ func (c *Claude) TraceFlag() string { return "--claude" }
 
 // Version implements Harness. `claude --version` prints "2.1.0 (Claude Code)".
 func (c *Claude) Version(ctx context.Context) (string, error) {
-	out, err := exec.CommandContext(ctx, c.bin(), "--version").Output() //nolint:gosec // the harness binary under test
+	out, err := exec.CommandContext(ctx, c.bin(), "--version").Output() //nolint:gosec // the harness binary under test // nosemgrep
 	if err != nil {
 		return "", fmt.Errorf("claude --version: %w", err)
 	}

app/cli/internal/trace/e2e/opencode.go

@@ -71,7 +71,7 @@ func (o *OpenCode) TraceFlag() string { return "--opencode" }
 // An installed major version that is not the one of the column is an error,
 // because the cells would test the wrong column.
 func (o *OpenCode) Version(ctx context.Context) (string, error) {
-	out, err := exec.CommandContext(ctx, o.bin(), "--version").Output() //nolint:gosec // the harness binary under test
+	out, err := exec.CommandContext(ctx, o.bin(), "--version").Output() //nolint:gosec // the harness binary under test // nosemgrep
 	if err != nil {
 		return "", fmt.Errorf("opencode --version: %w", err)
 	}

app/cli/internal/trace/e2e/workspace.go

@@ -173,7 +173,7 @@ func (w *Workspace) Git(ctx context.Context, args ...string) (string, error) {
 }
 
 func (w *Workspace) run(ctx context.Context, dir, name string, args ...string) (string, error) {
-	cmd := exec.CommandContext(ctx, name, args...)
+	cmd := exec.CommandContext(ctx, name, args...) //nolint:gosec // fixed commands of the e2e harness // nosemgrep
 	cmd.Dir = dir
 	cmd.Env = w.Env
 	var stderr bytes.Buffer

app/controlplane/plugins/plugins.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023 The Chainloop Authors.
+// Copyright 2023-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -195,7 +195,7 @@ func (i *goPluginInitializer) Init(path string) (*sdk.FanOutP, error) {
 	client := plugin.NewClient(&plugin.ClientConfig{
 		HandshakeConfig:  plugin_sdk.HandshakeConfig,
 		Plugins:          pluginSet,
-		Cmd:              exec.Command(path),
+		Cmd:              exec.Command(path), // path comes from plugin discovery in the operator-set plugins directory // nosemgrep
 		AllowedProtocols: []plugin.Protocol{plugin.ProtocolGRPC},
 		AutoMTLS:         true,
 	})

deployment/chainloop/Chart.yaml

@@ -7,7 +7,7 @@ description: Chainloop is an open source software supply chain control plane, a
 
 type: application
 # Bump the patch (not minor, not major) version on each change in the Chart Source code
-version: 1.476.0
+version: 1.476.1
 # Do not update appVersion, this is handled automatically by the release process
 appVersion: v1.128.1
 

deployment/chainloop/charts/dex/values.yaml

@@ -50,10 +50,10 @@ dex:
   staticUsers:
     - email: "john@chainloop.local"
       # password: "password"
-      hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
+      hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" # development-only user # nosemgrep
     - email: "sarah@chainloop.local"
       # password: "password"
-      hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
+      hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" # development-only user # nosemgrep
   ## @param dex.image.registry [default: REGISTRY_NAME] Dex image registry
   ## @param dex.image.repository [default: REPOSITORY_NAME/dex] Dex image repository
   ## @skip dex.image.tag Dex image tag (immutable tags are recommended)

deployment/chainloop/templates/_helpers.tpl

@@ -40,7 +40,7 @@ DEVELOPMENT ONLY PRIVATE KEY
 NOTE: It can not be generated by HELM because we also need a public key
 */}}
 {{- define "chainloop.casjwt.private_key.devel" -}}
------BEGIN EC PRIVATE KEY-----
+{{/* nosemgrep */}}-----BEGIN EC PRIVATE KEY-----
 MIHcAgEBBEIA762MbJK9IBnaqG0sd9uFRM+Z7Y+Aq5UfmbWf0+acKMYpYoy/8kBE
 tI6cpcA2KvmW5qurOjIMh5ISr+P2GmzSZX+gBwYFK4EEACOhgYkDgYYABAFzPMcM
 NUnPoC7b+s+/OyxRC7V/+elthj6Cq85WCj0KZ2qDvmd4QsYnsTIQ7NM7E+9WztdP