jekyll-client-search 0.3.1 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d3574c3adc2e2e00dd76ef5b5011358fcb9abfe3ed0cfbd372dffee00f913fc
-  data.tar.gz: 76f691ec62695d6e99677bc952fe85ae07c477df563f83b29f063a58f5b0d8c0
+  metadata.gz: d8289b785b9591674a7c171eea4ac3a3500765d79dd6679793a5c693879d7ed1
+  data.tar.gz: 2cc203750200af25356f75ca4e272747f39763f7abcfd9bedc9eff2ee9332b24
 SHA512:
-  metadata.gz: 23b5534d2c60626e5ee068687f2c4313f6e7494f1e382b89928f37b3eaf50fad3f979808e696c6a2bf3d17a5a00764674667b9f8f4041b4fc6f73a71953fcee7
-  data.tar.gz: 9403f90fd84ee7798fa07281001faf534028247e2f99aea46a9a305b8c3ac57191ae0059cb49ca8eb377b1ba7633b5960f3c481bc24e0cc6de872d30132b3521
+  metadata.gz: 9ffd9295cb6e23c001c8c88acbdeb5fa8252a47dd646c58ef5f09b4a0233fe88b026cea4c5f8a4b0cc9b03e2907377e6b070af3066c2b266752ad1e49163beaf
+  data.tar.gz: 90261e2e563cf3649913211bcded60669fe55abec5a9e5caf1fa049e4342874d4a33e2ff058b72c35817ed96fed92b88a10c94731c2f7c7467940413f4444211

data/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+## 0.3.2 — 2026-09-10
+
+### Added
+- Semgrep security scan in CI (`semgrep ci` job in `.github/workflows/ci.yml`) — runs on every push and pull request using the `SEMGREP_APP_TOKEN` secret and the Semgrep Pro engine with the organization's full policy (2,900+ rules)
+- `.semgrep.yml` with custom Ruby ReDoS detection rules and usage documentation
+- Semgrep step in pre-commit hook (`bin/install-hooks.sh`)
+- Dependabot configuration for GitHub Actions (`.github/dependabot.yml`) — weekly SHA-pinned action updates
+- CodeFactor and Semgrep badges in README.md
+- Documentation of CodeQL, Semgrep, CodeFactor, and Dependabot in README.md, README.developer.md, and AGENTS.md
+- Semgrep usage guide in README.developer.md (local commands, nosemgrep annotations, SHA pinning)
+
+### Fixed
+- Pin all GitHub Actions to full 40-character commit SHAs with version comments to prevent supply-chain attacks via mutable tag repointing (Semgrep: `github-actions-mutable-action-tag`)
+- Replace `Object.assign({}, entry, ...)` in benchmark with explicit field construction to avoid mass-assignment taint (Semgrep: `insecure-object-assign`)
+- Replace manual arXiv query string with `URI.encode_www_form` for correct URL encoding (Semgrep: `avoid-tainted-http-request`)
+
+### Changed
+- Add `nosemgrep` annotations with justifications for false positives (static ERB template, array-form `Open3.capture2`, fixed-host arXiv request) and acceptable risks (local loopback Ollama HTTP in tests and benchmarks)
+
 ## 0.3.1 — 2026-09-09
 
 ### Fixed

data/README.developer.md

@@ -24,9 +24,50 @@ are required for the default test run.
 ## Quality checks and git hooks
 
 The project uses a focused quality stack: RuboCop (style), bundler-audit
-(security), RSpec (Ruby tests), and `npm test` (JavaScript tests). This
-covers the actionable ground without the maintenance burden of additional
-code-smell tools on a small focused gem.
+(security), RSpec (Ruby tests), `npm test` (JavaScript tests), and Semgrep
+(security scanning). This covers the actionable ground without the
+maintenance burden of additional code-smell tools on a small focused gem.
+
+External automated code review services:
+- [CodeQL](https://codeql.github.com) — GitHub native security scanning
+  (Ruby + JavaScript), runs on every push.
+- [Semgrep](https://semgrep.dev) — CI security scan using the Semgrep Pro
+  engine with the organization's full policy (2,900+ rules). Runs as a CI
+  job (`semgrep ci`) and in the pre-commit hook (custom rules only). See
+  `.semgrep.yml` for local configuration and usage instructions.
+- [CodeFactor](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search) —
+  automated code review (RuboCop, Brakeman, bundler-audit, duplication).
+- [Dependabot](https://docs.github.com/en/code-security/dependabot) — weekly
+  GitHub Actions version updates (SHA-pinned actions updated automatically).
+
+### Semgrep usage
+
+The project uses two Semgrep scanning modes:
+
+1. **Pre-commit hook** — runs `semgrep scan --config .semgrep.yml` with only
+   the custom ReDoS rules defined in `.semgrep.yml`. Fast (~3s).
+2. **CI job** — runs `semgrep ci` with the full organization policy from the
+   Semgrep AppSec Platform, including Pro engine rules. Findings are uploaded
+   to the dashboard for triage.
+
+Local commands:
+
+```bash
+semgrep scan --config .semgrep.yml --error lib/ assets/   # custom rules only
+semgrep ci --dry-run                                        # full org policy, no upload
+semgrep ci                                                   # full org policy, upload to dashboard
+```
+
+To suppress a false positive or acceptable risk, add an inline annotation
+with the full rule ID and a justification:
+
+```ruby
+# nosemgrep: problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request
+# Acceptable risk: local loopback Ollama test endpoint.
+```
+
+All GitHub Actions are pinned to full 40-character commit SHAs with version
+comments. Dependabot updates the SHAs and version comments automatically.
 
 ### Rake tasks
 
@@ -55,12 +96,12 @@ This installs two hooks:
 
 | Hook | What it runs | When |
 | --- | --- | --- |
-| `pre-commit` | `rubocop` only (~2s) | Before each commit |
+| `pre-commit` | `rubocop + semgrep` (~5s) | Before each commit |
 | `pre-push` | `rubocop + rspec` (~15s) | Before each push |
 
-The pre-commit hook is intentionally fast (style only) to avoid bypassing
-with `--no-verify`. The full test suite runs on pre-push and in CI. Skip
-either with `git commit --no-verify` or `git push --no-verify`.
+The pre-commit hook is intentionally fast (style + security) to avoid
+bypassing with `--no-verify`. The full test suite runs on pre-push and in
+CI. Skip either with `git commit --no-verify` or `git push --no-verify`.
 
 ### CI checks
 
@@ -71,6 +112,7 @@ request across Ruby 3.2/3.3/3.4 and Node 22/24:
 - `bundle exec bundle-audit check --update` (Ruby dependency security)
 - `npm audit --audit-level=high` (JavaScript dependency security)
 - `npm outdated` (non-blocking — warns about outdated npm packages)
+- `semgrep ci` (security scan with custom rules from `.semgrep.yml`)
 
 ## Build-time related articles
 

data/README.md

@@ -8,6 +8,8 @@
 [![License: AGPL v3](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue.svg)](LICENSE)
 [![DeepWiki](https://img.shields.io/badge/DeepWiki-docs-7B68EE.svg)](https://deepwiki.com/gundestrup/jekyll-client-search)
 [![Coverage](https://img.shields.io/badge/coverage-100%25%20branches-brightgreen.svg)](#testing-strategy)
+[![Semgrep](https://img.shields.io/badge/semgrep-scanning-brightgreen.svg)](https://semgrep.dev)
+[![CodeFactor](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search/badge)](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search)
 
 A Jekyll plugin that generates a JSON document index for client-side search.
 Supports lexical search ([MiniSearch](https://lucaong.github.io/minisearch/),
@@ -1140,10 +1142,30 @@ bundle exec rake ci
 
 GitHub Actions are configured in `.github/workflows/`:
 
-- `ci.yml` runs the test and gem build checks on pushes and pull requests.
+- `ci.yml` runs the test and gem build checks on pushes and pull requests,
+  plus a Semgrep security scan job.
 - `release.yml` runs on `v*` tags or manual dispatch, verifies the gem, and
   publishes it using RubyGems trusted publishing.
 
+Additional automated code quality and security services:
+
+- [CodeQL](https://codeql.github.com) — GitHub native code scanning for
+  security vulnerabilities (Ruby + JavaScript).
+- [Semgrep](https://semgrep.dev) — CI security scan using the Semgrep Pro
+  engine with the organization's full policy (2,900+ rules). Custom ReDoS
+  detection rules are defined in `.semgrep.yml`. Findings are triaged on the
+  [Semgrep AppSec Platform](https://semgrep.dev) dashboard. False positives
+  and acceptable risks are annotated inline with `# nosemgrep: rule.id`.
+- [CodeFactor](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search) —
+  automated code review with RuboCop, Brakeman, bundler-audit, and duplication
+  checks.
+- [Dependabot](https://docs.github.com/en/code-security/dependabot) — weekly
+  checks for GitHub Actions version updates (SHA-pinned actions are kept
+  up to date automatically).
+
+All GitHub Actions are pinned to full 40-character commit SHAs with version
+comments to prevent supply-chain attacks via mutable tag repointing.
+
 Before enabling releases:
 
 1. Configure the GitHub repository as a RubyGems trusted publisher.

data/lib/jekyll/client_search/version.rb

@@ -2,6 +2,6 @@
 
 module Jekyll
   module ClientSearch
-    VERSION = "0.3.1"
+    VERSION = "0.3.2"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-client-search
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.2
 platform: ruby
 authors:
 - Svend Gundestrup