From e491aa02838477f203e8335ff16fb387d707ac4a Mon Sep 17 00:00:00 2001
From: Vishal Karmalkar <vishal.karmalkar@thoughtworks.com>
Date: Wed, 26 Aug 2026 16:45:43 +0530
Subject: [PATCH 1/2] BAH-5024 | Add Semgrep SAST CI workflow

Adds .github/workflows/semgrep.yml. Runs Semgrep Community Edition on PRs, pushes to main/master, and weekly. Phase 1 is non-blocking (continue-on-error: true) while initial findings are triaged. Findings upload to the Security tab via SARIF.

No SEMGREP_APP_TOKEN required; no Semgrep Cloud account.

Pinned to immutable digests/SHAs per the bahmni-core#330 template.
---
 .github/workflows/semgrep.yml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 .github/workflows/semgrep.yml

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
new file mode 100644
index 0000000..187ca76
--- /dev/null
+++ b/.github/workflows/semgrep.yml
@@ -0,0 +1,31 @@
+name: Semgrep SAST
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+  schedule:
+    - cron: '24 13 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  semgrep:
+    runs-on: ubuntu-latest
+    container:
+      # semgrep/semgrep:1.165.0 — pinned by digest; bump manually when needed
+      image: semgrep/semgrep@sha256:bd2ada83c7aa5a60e07d86ee84ba0c12282264781c8d783be5a912549a94394f
+    if: github.actor != 'dependabot[bot]'
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+        with:
+          persist-credentials: false
+      - run: semgrep scan --config auto --sarif --output semgrep.sarif
+        continue-on-error: true
+      - uses: github/codeql-action/upload-sarif@dd903d2e4f5405488e5ef1422510ee31c8b32357  # v3.36.2
+        if: always() && hashFiles('semgrep.sarif') != ''
+        with:
+          sarif_file: semgrep.sarif

From 3b625e6c71de62641a6279f8c3a22a49da3486ac Mon Sep 17 00:00:00 2001
From: vishalkarmalkarthoughtworks
 <96288645+vishalkarmalkarthoughtworks@users.noreply.github.com>
Date: Wed, 26 Aug 2026 19:15:38 +0530
Subject: [PATCH 2/2] BAH-5024 | Drop the weekly cron from the Semgrep workflow

GitHub disables a scheduled workflow in a public repo after 60 days with no
repository activity, and the disable applies to the whole workflow, not just
the cron trigger. Bahmni/bahmni-api-test-automation and
Bahmni/openmrs-module-bedmanagement had already lost Semgrep on every PR this
way, and GitHub does not re-enable it when the repo becomes active again.

Scanning on pull_request and on push to the default branch is unchanged, and
workflow_dispatch stays for an on-demand full scan.
---
 .github/workflows/semgrep.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 187ca76..de81807 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -4,8 +4,6 @@ on:
   pull_request:
   push:
     branches: [main, master]
-  schedule:
-    - cron: '24 13 * * 1'
   workflow_dispatch:
 
 permissions: