Add SAST scanning to CI pipeline

[sshdopey]

What

The CI workflow only runs npm test. No static analysis security testing (SAST) is performed. Common vulnerabilities go undetected.

Why

SAST tools catch security issues at code time before they reach production. Without them, vulnerabilities accumulate silently.

Scope

• Add Semgrep or CodeQL to CI workflow
• Configure for TypeScript/Node.js
• Run on every PR
• Fail on high/critical findings

Acceptance Criteria

• SAST tool configured in .github/workflows/ci.yml
• Runs on every PR
• Fails CI on high/critical vulnerabilities
• Reports are visible in PR checks

Technical Context

• .github/workflows/ci.yml — current CI pipeline
• Semgrep has a free tier for open source
• CodeQL is free for public repos

[Imran2210]

@Imran2210 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I’ve gone through the issue requirements and can implement a solution that meets the expected design and acceptance criteria.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Imran2210 to this issue.

[drips-wave]

Congratulations, @Imran2210! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @Imran2210: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊