From 1e8feeef71b1245cdcc3872f8fcf1d21afaf8ed2 Mon Sep 17 00:00:00 2001
From: cesnimda <dj@cesnimda.co.uk>
Date: Sat, 4 Jul 2026 16:01:34 +0200
Subject: [PATCH] ci(security): Semgrep SAST (#32)

---
 .gitea/workflows/security.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index c9a354e..cf69641 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -52,3 +52,21 @@ jobs:
         # (Vite/PostCSS/etc.) shouldn't block a merge.
         working-directory: frontend
         run: npm audit --omit=dev --audit-level=high
+
+  # RECOMMENDATIONS #9: SAST. Semgrep community rules for C#/JS + OWASP/secrets patterns —
+  # catches injection/crypto-misuse classes the other gates (gitleaks, dep-audit, tests)
+  # don't look for. Advisory at first (not a required check); promote once tuned.
+  sast:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # The runner image lacks pip, and a semgrep job-container lacks the node that
+      # actions/checkout needs — so install pip via apt on the standard image.
+      - name: Install semgrep
+        run: |
+          sudo apt-get update -qq && sudo apt-get install -y -qq python3-pip pipx
+          pipx install semgrep
+      - name: Semgrep scan
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          semgrep scan --config p/csharp --config p/javascript --config p/security-audit             --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj'             --error --quiet