semgrep.yml

name: Semgrep

# Taint-style SAST rules CodeQL's query packs do not cover (SEC-20's AUTO
# mechanism), plus IaC/Dockerfile/HTML checks that catch classes CodeQL
# doesn't (e.g. the missing-USER and missing-SRI findings fixed in the
# 2026-07-05 conformance remediation). Runs unauthenticated against the
# public Semgrep Registry ruleset; no SEMGREP_APP_TOKEN required or used.

# CICD §11e trigger shape (SAST): PRs into main + weekly schedule. No push
# trigger — the pull_request run already scanned the same changes before
# merge; the weekly run catches new Registry rules against unchanged code.
on:
  pull_request:
  schedule:
    - cron: "43 6 * * 1" # weekly, Monday 06:43 UTC (staggered after codeql.yml)

# Cancel superseded runs of the same ref (CICD §11c).
concurrency:
  group: semgrep-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep@sha256:59fbed6127ea7c5dde3ba6a85142733bb20ea9aaa36120c953904f1539aaf66e # 1.168.0
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false
      - run: semgrep ci --config auto