ci: add Semgrep OSS scanning workflow

[hrushikeshdeshpande]

Summary

Adds Semgrep Community Edition (OSS) scanning to this repository as part of the App&ProdSec team's migration from Semgrep Pro to Semgrep CE.

What it does

• Runs on every PR, on push to the main/master branch, and monthly on a staggered schedule.
• Uses actions/cache@v5 so pip install semgrep only runs on cold cache (first run, version bump, or 7-day idle).
• Pinned to semgrep==1.160.0 with --config=auto (default OSS ruleset).
• Runs on ubuntu-slim with contents: read token scope.

For reviewers

• Findings are informational; the job does not block on findings.
• First PR after merge installs Semgrep; subsequent PRs skip that step.

See the internal App&ProdSec email for migration context, or ping us internally.

[github-actions]

❌ Generated Data Mismatch

The following data files are out of date and need to be regenerated:

• data/baseline.json
• data/bun.json
• data/deno.json
• data/node-20.json
• data/node-22.json
• data/node-24.json
• data/workerd.json
• report/src/data/table-data.json
• report/src/data/versionMap.json
• report/public/runtime-support.csv

How to fix

Run the following command locally and commit the changes:

pnpm run generate

Note: This requires Node.js 20, 22, and 24 (via fnm), Bun, and Deno to be installed.

Download generated data

You can download the CI-generated data from the workflow artifacts.