[TECH-133] Add semgrep to pull requests (#8)

.github/workflows/semgrep-full-scan.yaml

@@ -0,0 +1,37 @@
+name: Semgrep Full Scan
+
+on:
+  workflow_dispatch:
+    branches:
+      - main
+  schedule:
+    - cron:  '0 9 * * 6'
+
+jobs:
+  semgrep-full:
+      runs-on: ubuntu-latest
+      container:
+        image: returntocorp/semgrep
+
+      steps:
+        - name: clone application source code
+          uses: actions/checkout@v3
+
+        - name: full scan
+          run: |
+            semgrep \
+              --sarif --output report.sarif \
+              --metrics=off \
+              --config="p/default"
+
+        - name: save report as pipeline artifact
+          uses: actions/upload-artifact@v3
+          with:
+            name: report.sarif
+            path: report.sarif
+
+        - name: publish code scanning alerts
+          uses: github/codeql-action/upload-sarif@v2
+          with:
+            sarif_file: report.sarif
+            category: semgrep

.github/workflows/semgrep-pull-request.yml

@@ -0,0 +1,25 @@
+name: Semgrep Pull Request Scan
+on:
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  semgrep-diff:
+    runs-on: ubuntu-latest
+    container:
+      image: returntocorp/semgrep
+
+    steps:
+      - name: clone application source code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: pull request scan
+        run: |
+          semgrep scan \
+            --error \
+            --verbose \
+            --time \
+            --baseline-commit ${{ github.event.pull_request.base.sha }} \
+            --config="p/default"