TECH-225 - Update semgrep pipeline

.github/workflows/semgrep.yml

@@ -0,0 +1,48 @@
+name: Semgrep scan
+
+on:
+  pull_request:
+    branches: ["main"]
+  workflow_dispatch: {}
+  schedule:
+    - cron: "0 9 * * 6"
+
+jobs:
+  semgrep:
+    runs-on: ubuntu-latest
+
+    container:
+      image: returntocorp/semgrep
+
+    steps:
+      - name: Checkout all commits and tags
+        uses: actions/checkout@v3
+        if: ${{ github.event_name == 'pull_request' }}
+        with:
+          fetch-depth: 0
+
+      - name: Checkout single commit
+        uses: actions/checkout@v3
+        if: ${{ github.event_name != 'pull_request' }}
+
+      - name: Pull request scan
+        if: ${{ github.event_name == 'pull_request' }}
+        run: semgrep scan --config=auto --verbose --time --error --baseline-commit ${{ github.event.pull_request.base.sha }}
+
+      - name: Full scan
+        if: ${{ github.event_name != 'pull_request' }}
+        run: semgrep scan --config=auto --verbose --time --sarif --output report.sarif
+
+      - name: Save report as pipeline artifact
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: report.sarif
+          path: report.sarif
+
+      - name: Publish code scanning alerts
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: report.sarif
+          category: semgrep