Commit 3ac725a2 authored by smartcontracts's avatar smartcontracts Committed by GitHub

ci: make semgrep-scan use a large docker image (#11834)

semgrep-scan kept failing with a medium docker image with 4g RAM.
Updating this image to large seems to fix the issue.
parent 89c3d35d
...@@ -1342,7 +1342,7 @@ jobs: ...@@ -1342,7 +1342,7 @@ jobs:
SEMGREP_COMMIT: << pipeline.git.revision >> SEMGREP_COMMIT: << pipeline.git.revision >>
docker: docker:
- image: returntocorp/semgrep - image: returntocorp/semgrep
resource_class: medium resource_class: large
steps: steps:
- checkout - checkout
- unless: - unless:
...@@ -1364,12 +1364,10 @@ jobs: ...@@ -1364,12 +1364,10 @@ jobs:
- run: - run:
name: "Semgrep scan" name: "Semgrep scan"
# --time shows which rules take the most time # --time shows which rules take the most time
# --max-memory (in MiB) limits memory usage
# (defaults to 5GB, but medium runner only has 4GB, so we conservatively limit it to 3GB)
# --timeout (in seconds) limits the time per rule and file. # --timeout (in seconds) limits the time per rule and file.
# SEMGREP_TIMEOUT is the same, but docs have conflicting defaults (5s in CLI flag, 1800 in some places) # SEMGREP_TIMEOUT is the same, but docs have conflicting defaults (5s in CLI flag, 1800 in some places)
# https://semgrep.dev/docs/troubleshooting/semgrep-app#if-the-job-is-aborted-due-to-taking-too-long # https://semgrep.dev/docs/troubleshooting/semgrep-app#if-the-job-is-aborted-due-to-taking-too-long
command: semgrep ci --time --timeout=100 --max-memory=3000 command: semgrep ci --time --timeout=100
# If semgrep hangs, stop the scan after 20m, to prevent a useless 5h job # If semgrep hangs, stop the scan after 20m, to prevent a useless 5h job
no_output_timeout: 20m no_output_timeout: 20m
- notify-failures-on-develop - notify-failures-on-develop
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment