ci: add Semgrep OSS scanning workflow

[hrushikeshdeshpande]

Summary

Adds Semgrep Community Edition (OSS) scanning to this repository as part of the App&ProdSec team's migration from Semgrep Pro to Semgrep CE.

What it does

• Runs on every PR, on push to the main/master branch, and monthly on a staggered schedule.
• Uses actions/cache@v5 so pip install semgrep only runs on cold cache (first run, version bump, or 7-day idle).
• Pinned to semgrep==1.160.0 with --config=auto (default OSS ruleset).
• Runs on ubuntu-slim with contents: read token scope.

For reviewers

• Findings are informational; the job does not block on findings.
• First PR after merge installs Semgrep; subsequent PRs skip that step.

See the internal App&ProdSec email for migration context, or ping us internally.

[ask-bonk]

Suggestion (medium): This repo's primary integration branch is staging — all PRs target it, and main only receives merges from staging at release time. Without staging in the push trigger, merged code is only scanned on PR (and again much later when it reaches main). Consider adding it:

Suggested change

	branches: [main, master]
	branches: [main, staging]

This also drops master, which doesn't exist in this repo.

[ask-bonk]

Needs Fix (medium): ubuntu-slim is not a standard GitHub-hosted runner label (ubuntu-latest, ubuntu-24.04, ubuntu-22.04 are). Every other workflow in this repo uses ubuntu-latest.

If this is a Cloudflare org-wide custom runner label, please disregard — but if not, this will cause the job to hang waiting for a runner that never arrives.

Suggested change

	runs-on: ubuntu-slim
	runs-on: ubuntu-latest

[ask-bonk]

Review submitted successfully. Here's a summary of the findings:

Needs Fix (1):

• Line 17 — runs-on: ubuntu-slim: Not a standard GitHub-hosted runner label. Every other workflow in this repo uses ubuntu-latest. Unless this is a Cloudflare org-wide custom runner, the job will queue indefinitely. Suggested fix: ubuntu-latest.

Suggestions (1):

• Line 5 — push branches missing staging: This repo's primary integration branch is staging (all PRs target it; main only receives release merges). The push trigger only covers [main, master], so merged code on staging won't be scanned until it reaches main. Also, master doesn't exist in this repo. Suggested fix: [main, staging].

github run