35 more Semgrep rules: infrastructure, supply chain, and Ruby

Summary: Trail of Bits published 35 new custom Semgrep rules, bringing its public total to 115, focused on supply chain issues such as missing short-lived OIDC tokens in GitHub Actions, infrastructure concerns in Terraform and Nomad, and Ruby application security. Many of the Ruby rules were written during the firm's recent audit of Ruby Central (rubygems.org), and the release includes what the firm says are the first open-source Semgrep rules targeting Nomad.
What you should know: The rules target misconfigurations that persist in 2024, including disabled TLS verification, hard-coded credentials, and AWS role policies for GitHub Actions missing the OIDC subject, which the post says could let any GitHub repository assume the role in CI.

Read the original at Trail of Bits Blog ↗