From 542d8443213c7092b06de9683f97a61a33119205 Mon Sep 17 00:00:00 2001
From: James Johnson <james.johnson@aerlingus.com>
Date: Sun, 18 Oct 2026 21:37:06 +0100
Subject: [PATCH] fix(sast): disable semgrep metrics via the env var only

---
 .forgejo/workflows/sast.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/sast.yml b/.forgejo/workflows/sast.yml
index 0f46e9c..abb14c0 100644
--- a/.forgejo/workflows/sast.yml
+++ b/.forgejo/workflows/sast.yml
@@ -20,9 +20,12 @@ jobs:
       - name: semgrep
         env:
           CONFIGS: ${{ inputs.config }}
+          # The env var, not --metrics=off: semgrep 1.90 still prints its
+          # "reports pseudonymous rule metrics" notice for registry configs
+          # when given only the flag, and does not with the env var.
           SEMGREP_SEND_METRICS: "off"
         run: |
           semgrep --version
-          set -- scan --error --metrics=off --disable-version-check
+          set -- scan --error --disable-version-check
           for c in $CONFIGS; do set -- "$@" --config "$c"; done
           semgrep "$@"