ci(security): Semgrep SAST gate (report-only) (#1797)

[ktursunov]

What

Stands up Semgrep (SAST) as its own report-only CI gate, split out of the
closed omnibus PR #1463 so the baseline can be triaged and ratcheted to blocking
independently (per the security-scanner umbrella #1478).

• New .github/workflows/semgrep.yml — single sast job:
  • semgrep scan --config p/default --exclude-rule generic.secrets.security.detected-generic-secret
    (secret detection is owned by the separate TruffleHog gate).
  • Report-only: runs without --error, so findings surface but never block.
  • Findings surface in Security → Code scanning (SARIF upload) and as a count in the job summary.
  • Triggers: PRs to main + nightly schedule (03:27 UTC) + workflow_dispatch; no path filter.
  • Digest-pinned Semgrep image run via docker run on ubuntu-latest (so checkout/upload-sarif
    keep the host runner's Node); SHA-pinned actions; job-scoped security-events: write;
    concurrency cancel-in-progress; fork-PR-safe SARIF upload.
• New .semgrepignore — prunes build/dependency artifacts (target/, .venv/, node_modules/, dist/);
  application and test source stay in scope.
• Program.cs — the pre-existing JWT ValidateLifetime = false finding is waived inline
  (// nosemgrep: … + #346), the one known high-severity item in the baseline.

Baseline (first p/default run: 124 findings)

Report-only on purpose — the baseline is not clean yet. Dominant category is 109
github-actions-mutable-action-tag findings in the existing workflows (a repo-wide
SHA-pin effort, tracked separately), plus ~13 product/tooling findings and 2 Dockerfile
missing-user findings. Triage happens in Code Scanning after this lands.

Exit condition (separate follow-up PR)

Flip to blocking by adding --error and marking sast a required check once the baseline is
clean (zero un-waived findings) — which depends on the mutable-tag follow-up + triaging the
remaining findings. Not part of this PR.

Test plan

• actionlint clean; the new workflow self-scans to 0 p/default findings (fully pinned).
• Baseline scan reproduced locally with the exact pinned image + command.
• JWT waiver verified to suppress the finding.

Closes #1797.
Part of #1478. Split from #1463.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d8fc1c21-f987-45cd-9e69-8412df58679e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch semgrep-collection

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.