Semgrep does not like null values in it's yaml files

[intrudir]

Below are the errors I get when running using the repo against the root dir like the README suggests, and having changed nothing:

(.venv) ➜  clientportal-be git:(dev) semgrep --config /opt/tools/semgrep/semgrep-rules .                            

┌──── ○○○ ────┐
│ Semgrep CLI │
└─────────────┘

semgrep error: null values prohibited
  --> /opt/tools/semgrep/semgrep-rules/.github/workflows/semgrep-rules-test.yml:3
2 | on:
3 |   pull_request:
  |                ^
4 |   push:

In semgrep YAML configuration, null values are prohibited

(.venv) ➜  clientportal-be git:(dev) semgrep --config /opt/tools/semgrep/semgrep-rules .                                                                  
                                                                                                                                                          
┌──── ○○○ ────┐                                                                                                                                           
│ Semgrep CLI │                                                                                                                                           
└─────────────┘                                                                                                                                           
                                                                                                                                                          
semgrep error: null values prohibited                                                                                                                     
  --> /opt/tools/semgrep/semgrep-rules/.github/workflows/semgrep-rules-format.yml:3                                                                       
2 | on:                                                                                                                                                   
3 |   pull_request:                                                                                                                                       
  |                ^                                                                                                                                      
4 |   push:                                                                  

If i comment out the affending lines, it appears to work but then we get a whole mess of other errors

[elopez]

Hi, thanks for the report! Unfortunately, newer semgrep versions (semgrep/semgrep#9779) will scan .github (where our CI workflows are installed) when loading rules, and wrongly assume that any yaml files on there are also rules. As a workaround, you can remove .github/ from your local repository copy before launching Semgrep.

[mschwager]

Another workaround is to run semgrep --config p/trailofbits .. This will use the trailofbits ruleset hosted in the Semgrep registry, which contains the exact same rules as this repository.

We should still either update our README with better instructions for running against a local checkout, or remove that as a recommended way to run these rules.

[intrudir]

Confirmed, thank you