security(semgrep): test run semgrep full

Author: moscaale

.github/workflows/security.yml

@@ -26,26 +26,24 @@ jobs:
         run: semgrep ci --config auto --sarif --output semgrep.sarif
         env:
           SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: semgrep.sarif
 
-  # Scan complet sur push main et releases (thorough)
   semgrep-full:
     name: Semgrep SAST (full)
-    if: github.event_name == 'push' || github.event_name == 'release' || github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'push' || github.event_name == 'release' || github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     container:
       image: semgrep/semgrep
     steps:
       - uses: actions/checkout@v4
       - name: Run Semgrep (full scan)
         run: semgrep scan --config auto --sarif --output semgrep.sarif
-        #    👆 "scan" au lieu de "ci" = scan complet, pas de diff
         env:
           SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: semgrep.sarif