diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ee526fbf..97037ff3 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -88,6 +88,4 @@ jobs:
         run: |
           nix run -f ./nix gomod2nix
           git diff --no-ext-diff --exit-code
-        with:
-          github-token: ${{ secrets.github_token }}
         if: env.GIT_DIFF
diff --git a/.semgrepignore b/.semgrepignore
index cb655af1..b65ff62f 100644
--- a/.semgrepignore
+++ b/.semgrepignore
@@ -19,6 +19,9 @@ test/
 tests/
 *_test.go
 
+# false positive
+testutil/network/network.go
+
 # Semgrep rules folder
 .semgrep
 
diff --git a/testutil/network/network.go b/testutil/network/network.go
index 23239816..c96fdaed 100644
--- a/testutil/network/network.go
+++ b/testutil/network/network.go
@@ -228,11 +228,7 @@ func NewCLILogger(cmd *cobra.Command) CLILogger {
 }
 
 // New creates a new Network for integration tests or in-process testnets run via the CLI
-// nosemgrep
-func New(l Logger, baseDir string, cfg Config) (*Network, error) { //nosemgrep
-	// nosemgrep
-	// ignore semgrep: Missing mutex unlock before returning from a function.
-	// unlocking in cleanup func
+func New(l Logger, baseDir string, cfg Config) (*Network, error) {
 	// only one caller/test can create and use a network at a time
 	l.Log("acquiring test network lock")
 	lock.Lock()
@@ -333,9 +329,8 @@ func New(l Logger, baseDir string, cfg Config) (*Network, error) { //nosemgrep
 				appCfg.JSONRPC.Address = cfg.JSONRPCAddress
 			} else {
 				_, jsonRPCPort, err := server.FreeTCPAddr()
-				if err != nil { // nosemgrep
-					// nosemgrep
-					return nil, err // nosemgrep
+				if err != nil {
+					return nil, err
 				}
 				appCfg.JSONRPC.Address = fmt.Sprintf("127.0.0.1:%s", jsonRPCPort)
 			}