Thomas Vincent 9476a306de ci(security): consolidated Semgrep + Psalm taint gate (#7306) ...

* ci(security): add consolidated Semgrep and Psalm taint gate

One workflow runs both taint scanners as separate jobs. Semgrep and Psalm
treat htmle()/html_escape()/sanitize_uri() as sanitizers, so findings mean
request input reaches a browser sink unescaped.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* stabilize psalm taint analysis

* Install dependencies before Psalm analysis

* Remove obsolete Psalm taint baseline

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

2026-07-20 20:29:57 -04:00

..

cacti-sanitizers.phpstub

ci(security): consolidated Semgrep + Psalm taint gate (#7306)

2026-07-20 20:29:57 -04:00