From 24caf6456629232c09e840d86f3a4c24dd23ac71 Mon Sep 17 00:00:00 2001
From: Ash <asyed@mozilla.com>
Date: Sat, 27 Jun 2026 12:20:19 -0400
Subject: [PATCH 1/2] add Semgrep CE to public and private
 code-security-analysis workflows

---
 .../code-security-analysis-private-repo.yml   | 40 ++++++++++++++++-
 .../code-security-analysis-public-repo.yml    | 44 +++++++++++++++++++
 2 files changed, 83 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/code-security-analysis-private-repo.yml b/.github/workflows/code-security-analysis-private-repo.yml
index b4a221e..e2ff6eb 100644
--- a/.github/workflows/code-security-analysis-private-repo.yml
+++ b/.github/workflows/code-security-analysis-private-repo.yml
@@ -1,5 +1,9 @@
 name: SSDLC Code Security Analysis
-description: Worfklow file for running code security analysis actions on private and internal repos
+description: |
+  Workflow file for running code security analysis actions on private and
+  internal repos. Runs zizmor (GitHub Actions security) and Semgrep CE
+  (application source security). Findings surface as workflow annotations on
+  the PR diff; the job fails when ERROR-severity Semgrep findings are present.
 
 on:
   workflow_call:
@@ -40,3 +44,37 @@ jobs:
           min-severity: high
           min-confidence: high
           fail-on-no-inputs: false
+
+  semgrep:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+
+      - name: Install Semgrep
+        run: pip install --no-cache-dir semgrep==1.168.0
+
+      # No GHAS on private repos — emit findings as workflow annotations on the
+      # diff, and fail the job on ERROR-severity findings so the ruleset blocks
+      # the PR when enforcement is Active. Repo admins can bypass.
+      - name: Run Semgrep
+        run: |
+          semgrep scan \
+            --config p/owasp-top-ten \
+            --config p/secrets \
+            --config p/security-audit \
+            --severity ERROR \
+            --error \
+            --metrics=off \
+            --disable-version-check \
+            .
diff --git a/.github/workflows/code-security-analysis-public-repo.yml b/.github/workflows/code-security-analysis-public-repo.yml
index 61b431c..135b9b5 100644
--- a/.github/workflows/code-security-analysis-public-repo.yml
+++ b/.github/workflows/code-security-analysis-public-repo.yml
@@ -39,3 +39,47 @@ jobs:
           min-severity: high
           min-confidence: high
           fail-on-no-inputs: false
+
+  semgrep:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+
+      - name: Install Semgrep
+        run: pip install --no-cache-dir semgrep==1.168.0
+
+      # Run Semgrep CE with the OWASP Top 10, secrets, and general security audit
+      # rulesets. ERROR severity only — high-confidence, exploitable patterns.
+      # `--error` is omitted here: SARIF upload publishes findings to the GHAS
+      # Security tab regardless of exit status, and we don't want to block the
+      # workflow run on findings (the org ruleset enforces blocking, not this job).
+      - name: Run Semgrep (SARIF)
+        run: |
+          semgrep scan \
+            --config p/owasp-top-ten \
+            --config p/secrets \
+            --config p/security-audit \
+            --severity ERROR \
+            --sarif --output semgrep.sarif \
+            --metrics=off \
+            --disable-version-check \
+            .
+
+      - name: Upload Semgrep SARIF to GitHub code scanning
+        if: ${{ always() && hashFiles('semgrep.sarif') != '' }}
+        uses: github/codeql-action/upload-sarif@b0c4fd77f6c559021d78430ec4d0d169ae74a4eb # v3
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep

From f1d0e5c3a9c5ff304a7fe2d9e04db8d860853415 Mon Sep 17 00:00:00 2001
From: Ash <asyed@mozilla.com>
Date: Sat, 27 Jun 2026 12:51:34 -0400
Subject: [PATCH 2/2] Update code-security-analysis-public-repo.yml

---
 .github/workflows/code-security-analysis-public-repo.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/code-security-analysis-public-repo.yml b/.github/workflows/code-security-analysis-public-repo.yml
index 135b9b5..0f2b9f8 100644
--- a/.github/workflows/code-security-analysis-public-repo.yml
+++ b/.github/workflows/code-security-analysis-public-repo.yml
@@ -79,7 +79,7 @@ jobs:
 
       - name: Upload Semgrep SARIF to GitHub code scanning
         if: ${{ always() && hashFiles('semgrep.sarif') != '' }}
-        uses: github/codeql-action/upload-sarif@b0c4fd77f6c559021d78430ec4d0d169ae74a4eb # v3
+        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           sarif_file: semgrep.sarif
           category: semgrep