fix semgrep ci

labring · Oct 16, 2023 · 942d9d0 · 942d9d0
1 parent c4f1da2
commit 942d9d0
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 5 deletions.
diff --git a/.github/workflows/check-semgrep.yml b/.github/workflows/check-semgrep.yml
@@ -2,11 +2,23 @@
 name: Check-Semgrep
 
 on:
-  # Scan changed files in PRs (diff-aware scanning):
-  pull_request: {}
-  # Scan mainline branches and report all findings:
+  workflow_dispatch:
   push:
-    branches: ["main"]
+    branches: [ "main" ]
+    paths-ignore:
+      - "docs/**"
+      - "**/*.md"
+      - "**/*.yaml"
+      - "CONTRIBUTORS"
+      - "CHANGELOG/**"
+  pull_request:
+    branches: [ "*" ]
+    paths-ignore:
+      - "docs/**"
+      - "**/*.md"
+      - "**/*.yaml"
+      - "CONTRIBUTORS"
+      - "CHANGELOG/**"
 
 jobs:
   semgrep:

diff --git a/service/pay/deploy/manifests/deploy.yaml b/service/pay/deploy/manifests/deploy.yaml
@@ -47,7 +47,9 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      securityContext:
+        allowPrivilegeEscalation: false
+        runAsNonRoot: true
       terminationGracePeriodSeconds: 30
 ---
 apiVersion: v1