CID-17067 - Add renovate to update semgrep

[andrewlundberg-wf]

The gha-security-scanner is currently pinned to a version of semgrep that is over a year old. This dependency should be updated and maintained to ensure we are using the latest security rules and fixes.

Acceptance Criteria
Update the scanner to use the latest version of semgrep (see: https://github.com/semgrep/semgrep/releases

Implement automatic updates so that semgrep is updated at least weekly

Reference point for current version pin:https://github.com/Workiva/gha-security-scanner/blob/master/src/main.ts#L48

Sample of run with renovate configuration

[btr-rmconsole-6]

Merge Requirements Met ✅

Request Rosie to automerge this pull request by including @Workiva/release-management-p in a comment.

General Information

Ticket(s):

• CID-17067 | remove

Code Review(s): #110
Release Image Tags:

Reviewers: jonasray-wf

Additional Information

Watchlist Notifications: None

	When this pull is merged I will add it to the following release:
	Version: gha-security-scanner v0.1.2
	Release Ticket(s): None

---

Note: This is a shortened report. Click here to view Rosie's full evaluation.
Last updated on Monday, September 22 01:11 PM CST

[github-actions]

Security Audit Results

Please direct questions to #support-infosec.

Commit Signing

✅ All commits are signed

Raven

✅ 40 global file checks pass
✅ 93 global keyword checks pass

Images

✅ No Dockerfiles in this PR

Workflows

✅ .github/workflows/gha-security-scanner.yaml found.

[jonasray-wf]

@Workiva/release-management-p

[rmconsole-wf]

+1 from RM