ci: add Semgrep SAST scanning on pull requests

[ulziibay-kernel]

Adds Semgrep static analysis on PRs to main via the reusable workflow in kernel/security-workflows. Includes .semgrepignore for generated code, test fixtures, and lock files.

Made with Cursor

---

Note

Low Risk
Low risk CI-only change that adds static analysis on PRs and ignores generated/third-party files; main impact is potential new PR check failures/noise.

Overview
Adds a Semgrep SAST GitHub Actions workflow that runs on pull requests to main via the reusable kernel/security-workflows workflow, scanning with the p/golang and p/javascript rulesets.

Introduces a .semgrepignore to exclude dependencies, build artifacts, lockfiles, tests, and specific generated/fixture paths from scanning.

^{Reviewed by Cursor Bugbot for commit 42c18c8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR only modifies CI configuration and Semgrep settings, not kernel API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.

[cursor]

Missing bun.lock in .semgrepignore lock file list

Low Severity

The .semgrepignore includes go.sum and package-lock.json as lock files to ignore, but the repository actually uses bun.lock (present at the repo root alongside package.json with @types/bun as a dev dependency). This lock file is not listed in the ignore file, inconsistent with the stated intent to exclude lock files from scanning.

 

^{Reviewed by Cursor Bugbot for commit a2daadf. Configure here.}

[Sayan-]

LGTM — standard Semgrep reusable workflow rollout. Good .semgrepignore coverage for generated oapi.go, headful client, and cdp-test.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 42c18c8. Configure here.}

[cursor]

Generated file not excluded from Semgrep scanning

Low Severity

The .semgrepignore excludes server/lib/oapi/oapi.go as generated code, but misses server/lib/policy/policy_registry.go, which is also auto-generated (marked // Code generated by generate_registry.py ... DO NOT EDIT.). This large 500+ line file of map literals will be scanned by Semgrep, likely producing false positives on code that developers don't maintain by hand.

 

^{Reviewed by Cursor Bugbot for commit 42c18c8. Configure here.}