ci(security): add Semgrep SAST gate (#485)

Adds a required semgrep job (p/golang, p/typescript, p/react,
p/owasp-top-ten; blocking on ERROR severity only) wired into
ci-complete's needs, replicating seed #1737. CodeQL is advisory and
skipped on private repos, so Semgrep becomes the required SAST signal;
corrects the ci-complete comments, which still claimed CodeQL/
license-check were required contexts (branch protection actually
requires only CI Complete + Lint PR Title/Body).

No ERROR findings exist on current main. Annotates the one known
WARNING-severity false positive (HIBP SHA-1 k-anonymity API contract in
internal/auth/hibp.go) with a nosemgrep justification ahead of a future
WARNING ratchet.

Author: krisarmstrong

.github/workflows/ci.yml

@@ -517,6 +517,51 @@ jobs:
         with:
           sarif_file: trivy-results.sarif
 
+  # ===========================================================================
+  # Semgrep SAST — required gate (Phase 4, replaces CodeQL as the required
+  # SAST signal since CodeQL is skipped entirely on private repos)
+  # ===========================================================================
+  # Blocking on ERROR severity only for now — a deliberate first step,
+  # mirroring seed #1737. WARNING/MEDIUM findings are visible in the job log
+  # but do not fail the build yet; ratchet to a stricter --severity once the
+  # current WARNING backlog is triaged in a follow-up. One known false
+  # positive is already annotated inline with `// nosemgrep: <rule-id> --
+  # <reason>` (mirroring the existing `#nosec` justifications) so the
+  # ratchet won't need to re-litigate it: internal/auth/hibp.go (SHA-1 is
+  # the HIBP k-anonymity API contract).
+  #
+  # Runs unconditionally (no path filter) — same rationale as `security`
+  # above: SAST coverage on every PR is non-negotiable, and Semgrep is fast
+  # enough (~1-2 min for this ruleset) that gating it behind path filters
+  # isn't worth the added complexity.
+  semgrep:
+    name: Semgrep SAST
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up Python
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: "3.13"
+
+      - name: Install Semgrep (pinned)
+        run: pip install "semgrep==1.168.0"
+
+      - name: Run Semgrep (blocking on ERROR severity)
+        run: |
+          semgrep scan \
+            --config p/golang \
+            --config p/typescript \
+            --config p/react \
+            --config p/owasp-top-ten \
+            --severity ERROR \
+            --error \
+            --metrics=off
+
   # ============================================================================
   # Quality
   # ============================================================================
@@ -948,10 +993,14 @@ jobs:
   # Every required-status-check on `main` is consolidated into this single
   # job. It fails if any upstream job actually failed; it passes if every
   # upstream either succeeded or was intentionally skipped via the path
-  # filter. Branch protection should require ONLY "CI Complete" plus the
-  # security-critical checks from other workflows (CodeQL, license-check) —
-  # not every individual job — so docs-only PRs merge cleanly when
-  # backend/frontend/c are all skipped.
+  # filter. Branch protection requires ONLY "CI Complete" (plus "Lint PR
+  # Title" / "Lint PR Body" from their own workflows) rather than
+  # enumerating every individual job — so a docs-only PR can merge cleanly
+  # when backend/frontend/c are all skipped. CodeQL and license-check are
+  # NOT required contexts: CodeQL is advisory (and skips entirely on
+  # private repos) and license-check reports without blocking. The
+  # `semgrep` job in this file is the required SAST gate (blocking on
+  # ERROR severity).
   ci-complete:
     name: CI Complete
     runs-on: ubuntu-latest
@@ -969,6 +1018,7 @@ jobs:
       - c-lint
       - dataplane-safety
       - security
+      - semgrep
       - quality
       - i18n
       - docs

internal/auth/hibp.go

@@ -113,6 +113,7 @@ func CheckPasswordBreached(ctx context.Context, password string) (bool, int, err
 	// full hash never leaves this function, and the API's protocol is
 	// fixed to SHA-1; a "stronger" hash would simply not match HIBP's
 	// corpus. See https://haveibeenpwned.com/API/v3#PwnedPasswords.
+	// nosemgrep: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 -- HIBP k-anonymity API mandates SHA-1, same rationale as the #nolint
 	hash := sha1.Sum([]byte(password)) //nolint:gosec // HIBP requires SHA-1.
 	hex := strings.ToUpper(hex.EncodeToString(hash[:]))
 	if len(hex) != hibpPrefixLen+hibpSuffixLen {