The runner's job image lacks pip, so the sast job failed in CI despite passing locally. Use the semgrep/semgrep container instead of installing via pip. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
p/csharp + p/javascript + p/security-audit rulesets; advisory (not a required check) until tuned. Verified locally: current codebase scans clean (0 findings). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cesnimda
cesnimda