BAH-4795 | Add Semgrep SAST CI workflow

[vishalkarmalkarthoughtworks]

Summary

Adds .github/workflows/semgrep.yml. Runs Semgrep Community Edition static analysis on PRs, pushes to the default branch, and weekly. Findings upload to the Security tab (Code Scanning) via SARIF.

Part of the org-wide rollout tracked in BAH-4795. Template validated on bahmni-core#330.

Phase 1 — non-blocking

continue-on-error: true so existing findings do not block PRs. Findings still surface in the Security tab. A follow-up will flip to blocking with --baseline-ref once baselines are triaged.

Cost: $0

Semgrep Community Edition (LGPL-2.1) + public registry rules + free GitHub Code Scanning on public repos. No SEMGREP_APP_TOKEN, no Semgrep Cloud account.

Supply-chain hardening

• Container image and actions pinned to immutable SHAs/digests
• persist-credentials: false on checkout (least privilege)
• SARIF upload guarded by hashFiles() so the workflow stays truly non-blocking if Semgrep crashes before producing the SARIF

Test plan

• Workflow appears in Actions tab and runs on this PR
• Scan completes (success or non-zero — both OK in phase 1)
• SARIF uploads to Security tab (visible to write+ collaborators)
• Subsequent push to default branch triggers the workflow

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[ravinderkabli]

Looks fine