3 people bdc03d0a7f ci: add semgrep SAST scanning to CI and pre-commit (#14964) ...

* ci: add semgrep SAST scanning to CI and pre-commit

Add semgrep static analysis to the security workflow and pre-commit
hooks. Uses `--config auto` for comprehensive coverage across Python,
Dockerfile, and GitHub Actions. The intentional `USER root` in the
Dockerfile (required for bind mount compatibility) is excluded via
`--exclude-rule`.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* ci: pin semgrep container image to digest for zizmor

Pin semgrep/semgrep to sha256 digest (v1.151.0) to satisfy
zizmor's unpinned-images audit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* ci: add zizmor pre-commit hook for Actions security audit

Matches the existing actionlint pattern — gracefully skips if zizmor
is not installed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-08 11:59:30 -05:00

..

docker-image.yaml

chore(deps): bump docker/login-action in the github-actions group (#14960)

2026-02-08 09:24:08 -05:00

integration-tests.yml

ci: modernize tooling with prek, ty, and security scanning (#14956)

2026-01-30 00:10:05 -05:00

lint.yml

fix: add explicit bool filters for Ansible 12 jinja2_native compatibility (#14963)

2026-02-08 11:21:56 -05:00

main.yml

chore(deps): bump actions/setup-python in the github-actions group (#14954)

2026-01-29 23:13:03 -05:00

security.yml

ci: add semgrep SAST scanning to CI and pre-commit (#14964)

2026-02-08 11:59:30 -05:00

smart-tests.yml

fix: add explicit bool filters for Ansible 12 jinja2_native compatibility (#14963)

2026-02-08 11:21:56 -05:00

test-effectiveness.yml

ci: modernize tooling with prek, ty, and security scanning (#14956)

2026-01-30 00:10:05 -05:00