From 4b0af5daae4383be8043e40a806b4e45293b8549 Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Wed, 29 Apr 2026 15:45:54 -0400
Subject: [PATCH 01/12] Add README and Semgrep OSS workflow

---
 .github/workflows/semgrep.yml | 48 +++++++++++++++++++++++++++++++++++
 README.md                     | 19 ++++++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 .github/workflows/semgrep.yml
 create mode 100644 README.md

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
new file mode 100644
index 0000000..f5a54a1
--- /dev/null
+++ b/.github/workflows/semgrep.yml
@@ -0,0 +1,48 @@
+name: Semgrep OSS
+
+on:
+  pull_request: {}
+  workflow_dispatch: {}
+  merge_group:
+    types: [checks_requested]
+  schedule:
+    # Full scan of main every Monday at 06:17 UTC.
+    # Randomized time to avoid GHA load spikes.
+    - cron: '17 6 * * 1'
+
+jobs:
+  semgrep:
+    name: semgrep/oss
+    runs-on: ubuntu-latest
+    container:
+      image: semgrep/semgrep
+    permissions:
+      contents: read
+      security-events: write  # Required for SARIF upload to GitHub Code Scanning
+      actions: read
+    # Skip Dependabot PRs and merge group events (diff scan not useful pre-merge)
+    if: |
+      github.actor != 'dependabot[bot]' &&
+      github.actor != 'github-actions[bot]' &&
+      github.event_name != 'merge_group'
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Run Semgrep OSS
+        # Runs in CI mode: diff-aware on PRs, full scan on push/schedule.
+        # No SEMGREP_APP_TOKEN = fully OSS/local mode; no data leaves the runner.
+        # SEMGREP_RULES sets the community rulesets to apply.
+        run: semgrep ci --sarif --output=semgrep.sarif
+        env:
+          SEMGREP_RULES: >-
+            p/default
+            p/security-audit
+            p/owasp-top-ten
+
+      - name: Upload findings to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        # Upload even on scan failure so findings are visible in the Security tab
+        if: always()
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep-oss
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..912a559
--- /dev/null
+++ b/README.md
@@ -0,0 +1,19 @@
+# security-workflows-public
+
+Public AppSec tooling from Gemini's security engineering team, adapted for use in open source projects.
+
+## What's Here
+
+This repository contains security workflows, scanners, and automation tools for securing Gemini's open source projects.
+
+## Tools
+
+_Tools will be added here as they are published._
+
+## Contributing
+
+This repository is maintained by Gemini's AppSec team. External contributions and feedback are welcome via GitHub Issues.
+
+## License
+
+See [LICENSE](LICENSE) for details.

From dbb06629c40eb662d47d88c8b16aae8f724a8cac Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Wed, 29 Apr 2026 17:27:21 -0400
Subject: [PATCH 02/12] Add Socket Security supply chain workflow

---
 .github/workflows/socket.yml | 109 +++++++++++++++++++++++++++++++++++
 1 file changed, 109 insertions(+)
 create mode 100644 .github/workflows/socket.yml

diff --git a/.github/workflows/socket.yml b/.github/workflows/socket.yml
new file mode 100644
index 0000000..19860eb
--- /dev/null
+++ b/.github/workflows/socket.yml
@@ -0,0 +1,109 @@
+name: Socket Security
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches:
+      - main
+      - master
+  issue_comment:
+    types: [created]
+  workflow_dispatch: {}
+
+# Prevent redundant concurrent runs for the same commit
+concurrency:
+  group: socket-${{ github.ref }}-${{ github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  socket:
+    name: socket/supply-chain
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write  # Required for Socket to post PR comments
+      issues: write         # Required for Socket to post issue comments
+    # Skip Dependabot PRs (Socket handles its own dependency updates)
+    if: |
+      github.actor != 'dependabot[bot]' &&
+      (github.event_name == 'push' && format('refs/heads/{0}', github.event.repository.default_branch) == github.ref ||
+       github.event_name == 'pull_request' ||
+       github.event_name == 'issue_comment')
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: ${{ github.event_name == 'pull_request' && 2 || 0 }}
+
+      - name: Get changed files
+        id: changed-files
+        run: |
+          if ${{ github.event_name == 'pull_request' }}; then
+            echo "changed_files=$(git diff --name-only -r HEAD^1 HEAD | xargs)" >> $GITHUB_OUTPUT
+          else
+            echo "changed_files=$(git diff --name-only ${{ github.event.before }} ${{ github.event.after }} | xargs)" >> $GITHUB_OUTPUT
+          fi
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.12'
+
+      - name: Get PR State
+        if: github.event_name == 'pull_request'
+        run: echo "EVENT_ACTION=${{ github.event.action }}" >> $GITHUB_ENV
+
+      - name: Install Socket CLI
+        run: pip install socketsecurity --upgrade
+
+      - name: Check if Default Branch
+        if: ${{ always() && format('refs/heads/{0}', github.event.repository.default_branch) == github.ref }}
+        run: echo "DEFAULT_BRANCH=1" >> $GITHUB_ENV
+
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        id: get_pr_data
+        with:
+          script: |
+            let data = (
+              await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                commit_sha: context.sha,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+              })
+            ).data[0];
+            if (data === undefined) {
+              data = {
+                'number': null,
+                'title': null
+              }
+            }
+            return data;
+
+      - name: Save Pull Request Number
+        run: |
+          echo "PR_NUMBER=${{ fromJson(steps.get_pr_data.outputs.result).number || github.event.issue.number || github.event.number }}" >> $GITHUB_ENV
+
+      - name: Run Socket Security Scan
+        # Socket scans dependency manifests (package.json, requirements.txt, go.mod, etc.)
+        # and alerts on supply chain risks: malware, typosquats, suspicious packages.
+        # SOCKET_SECURITY_API_KEY should be set as an org secret scoped to public repos.
+        env:
+          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
+          GH_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+        run: |
+          CHANGED_FILES=$(echo "${{ steps.changed-files.outputs.changed_files }}" | tr " " "\n")
+          FILES=""
+          while IFS= read -r line; do
+            FILES="$FILES\"$line\","
+          done <<< "$CHANGED_FILES"
+          FILES=$(echo $FILES | sed 's/,*$//')
+          socketcli \
+            --files "[$FILES]" \
+            --scm github \
+            --repo ${{ github.event.repository.name }} \
+            --branch "${{ github.ref_name }}" \
+            $(if [ ! -z $DEFAULT_BRANCH ]; then echo "--default_branch"; fi) \
+            --pr_number $(if [ -z $PR_NUMBER ]; then echo 0; else echo $PR_NUMBER; fi) \
+            --committer "$GITHUB_ACTOR" \
+            --commit_message "$COMMIT_MESSAGE" \
+            --target_path $GITHUB_WORKSPACE

From d4fccc5cf67da932ce5475568178721a1a7c3934 Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Wed, 29 Apr 2026 17:28:34 -0400
Subject: [PATCH 03/12] Fix Socket CLI env var name: SOCKET_SECURITY_API_KEY ->
 SOCKET_SECURITY_API_TOKEN

---
 .github/workflows/socket.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/socket.yml b/.github/workflows/socket.yml
index 19860eb..01f0fdd 100644
--- a/.github/workflows/socket.yml
+++ b/.github/workflows/socket.yml
@@ -87,7 +87,7 @@ jobs:
         # and alerts on supply chain risks: malware, typosquats, suspicious packages.
         # SOCKET_SECURITY_API_KEY should be set as an org secret scoped to public repos.
         env:
-          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
+          SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_KEY }}
           GH_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
         run: |

From ea0a557fd598466aa2a6d767684b6378e9b36283 Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Wed, 29 Apr 2026 17:33:36 -0400
Subject: [PATCH 04/12] Remove Socket Security workflow

---
 .github/workflows/socket.yml | 109 -----------------------------------
 1 file changed, 109 deletions(-)
 delete mode 100644 .github/workflows/socket.yml

diff --git a/.github/workflows/socket.yml b/.github/workflows/socket.yml
deleted file mode 100644
index 01f0fdd..0000000
--- a/.github/workflows/socket.yml
+++ /dev/null
@@ -1,109 +0,0 @@
-name: Socket Security
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-  push:
-    branches:
-      - main
-      - master
-  issue_comment:
-    types: [created]
-  workflow_dispatch: {}
-
-# Prevent redundant concurrent runs for the same commit
-concurrency:
-  group: socket-${{ github.ref }}-${{ github.sha }}
-  cancel-in-progress: true
-
-jobs:
-  socket:
-    name: socket/supply-chain
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write  # Required for Socket to post PR comments
-      issues: write         # Required for Socket to post issue comments
-    # Skip Dependabot PRs (Socket handles its own dependency updates)
-    if: |
-      github.actor != 'dependabot[bot]' &&
-      (github.event_name == 'push' && format('refs/heads/{0}', github.event.repository.default_branch) == github.ref ||
-       github.event_name == 'pull_request' ||
-       github.event_name == 'issue_comment')
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          fetch-depth: ${{ github.event_name == 'pull_request' && 2 || 0 }}
-
-      - name: Get changed files
-        id: changed-files
-        run: |
-          if ${{ github.event_name == 'pull_request' }}; then
-            echo "changed_files=$(git diff --name-only -r HEAD^1 HEAD | xargs)" >> $GITHUB_OUTPUT
-          else
-            echo "changed_files=$(git diff --name-only ${{ github.event.before }} ${{ github.event.after }} | xargs)" >> $GITHUB_OUTPUT
-          fi
-
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: '3.12'
-
-      - name: Get PR State
-        if: github.event_name == 'pull_request'
-        run: echo "EVENT_ACTION=${{ github.event.action }}" >> $GITHUB_ENV
-
-      - name: Install Socket CLI
-        run: pip install socketsecurity --upgrade
-
-      - name: Check if Default Branch
-        if: ${{ always() && format('refs/heads/{0}', github.event.repository.default_branch) == github.ref }}
-        run: echo "DEFAULT_BRANCH=1" >> $GITHUB_ENV
-
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        id: get_pr_data
-        with:
-          script: |
-            let data = (
-              await github.rest.repos.listPullRequestsAssociatedWithCommit({
-                commit_sha: context.sha,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-              })
-            ).data[0];
-            if (data === undefined) {
-              data = {
-                'number': null,
-                'title': null
-              }
-            }
-            return data;
-
-      - name: Save Pull Request Number
-        run: |
-          echo "PR_NUMBER=${{ fromJson(steps.get_pr_data.outputs.result).number || github.event.issue.number || github.event.number }}" >> $GITHUB_ENV
-
-      - name: Run Socket Security Scan
-        # Socket scans dependency manifests (package.json, requirements.txt, go.mod, etc.)
-        # and alerts on supply chain risks: malware, typosquats, suspicious packages.
-        # SOCKET_SECURITY_API_KEY should be set as an org secret scoped to public repos.
-        env:
-          SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_KEY }}
-          GH_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
-        run: |
-          CHANGED_FILES=$(echo "${{ steps.changed-files.outputs.changed_files }}" | tr " " "\n")
-          FILES=""
-          while IFS= read -r line; do
-            FILES="$FILES\"$line\","
-          done <<< "$CHANGED_FILES"
-          FILES=$(echo $FILES | sed 's/,*$//')
-          socketcli \
-            --files "[$FILES]" \
-            --scm github \
-            --repo ${{ github.event.repository.name }} \
-            --branch "${{ github.ref_name }}" \
-            $(if [ ! -z $DEFAULT_BRANCH ]; then echo "--default_branch"; fi) \
-            --pr_number $(if [ -z $PR_NUMBER ]; then echo 0; else echo $PR_NUMBER; fi) \
-            --committer "$GITHUB_ACTOR" \
-            --commit_message "$COMMIT_MESSAGE" \
-            --target_path $GITHUB_WORKSPACE

From a2496d1076cff535d6be4b56ad590dc71e8358be Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Thu, 30 Apr 2026 11:46:22 -0400
Subject: [PATCH 05/12] Rewrite scan-for-secrets to use TruffleHog, matching
 org standard

---
 .github/workflows/scan-for-secrets.yml | 43 ++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 .github/workflows/scan-for-secrets.yml

diff --git a/.github/workflows/scan-for-secrets.yml b/.github/workflows/scan-for-secrets.yml
new file mode 100644
index 0000000..629cebd
--- /dev/null
+++ b/.github/workflows/scan-for-secrets.yml
@@ -0,0 +1,43 @@
+name: Scan for Secrets
+
+on:
+  pull_request: {}
+  merge_group:
+    types: [checks_requested]
+  workflow_dispatch: {}
+
+jobs:
+  scan_for_secrets:
+    name: scan_for_secrets
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    # Skip Dependabot PRs and auto-pass in merge queue (base branch already scanned)
+    if: |
+      github.actor != 'dependabot[bot]' &&
+      github.actor != 'github-actions[bot]'
+    steps:
+      - name: Establish event metadata
+        id: establish_metadata
+        shell: bash
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "fetch_depth=$((${{ github.event.pull_request.commits }} + 2))" >> $GITHUB_OUTPUT
+            echo "branch=${{ github.event.pull_request.head.ref }}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Auto-pass in merge queue
+        if: github.event_name == 'merge_group'
+        run: echo 'Auto-passing in merge queue'
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        if: github.event_name == 'pull_request'
+        with:
+          ref: ${{ steps.establish_metadata.outputs.branch }}
+          fetch-depth: ${{ steps.establish_metadata.outputs.fetch_depth }}
+
+      - name: Scan for secrets
+        if: github.event_name == 'pull_request'
+        uses: trufflesecurity/trufflehog@939f053fc5cc13136efeb9e4d505051455d135dd
+        with:
+          extra_args: --only-verified

From d671d43e0e3abe6eff2c2db518a244f81e5f7fca Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Thu, 30 Apr 2026 11:48:50 -0400
Subject: [PATCH 06/12] Rename job display names to 'public'

---
 .github/workflows/scan-for-secrets.yml | 2 +-
 .github/workflows/semgrep.yml          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scan-for-secrets.yml b/.github/workflows/scan-for-secrets.yml
index 629cebd..45bc4f6 100644
--- a/.github/workflows/scan-for-secrets.yml
+++ b/.github/workflows/scan-for-secrets.yml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   scan_for_secrets:
-    name: scan_for_secrets
+    name: public
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index f5a54a1..22cc147 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -12,7 +12,7 @@ on:
 
 jobs:
   semgrep:
-    name: semgrep/oss
+    name: public
     runs-on: ubuntu-latest
     container:
       image: semgrep/semgrep

From a4ba75b2027990bf24b22f3f7600551d3c7777ef Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Thu, 30 Apr 2026 11:50:10 -0400
Subject: [PATCH 07/12] Fix script injection: use env vars instead of direct
 context interpolation in run steps

---
 .github/workflows/scan-for-secrets.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/scan-for-secrets.yml b/.github/workflows/scan-for-secrets.yml
index 45bc4f6..ee267f7 100644
--- a/.github/workflows/scan-for-secrets.yml
+++ b/.github/workflows/scan-for-secrets.yml
@@ -20,10 +20,14 @@ jobs:
       - name: Establish event metadata
         id: establish_metadata
         shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_COMMITS: ${{ github.event.pull_request.commits }}
+          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
         run: |
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo "fetch_depth=$((${{ github.event.pull_request.commits }} + 2))" >> $GITHUB_OUTPUT
-            echo "branch=${{ github.event.pull_request.head.ref }}" >> $GITHUB_OUTPUT
+          if [[ "$EVENT_NAME" == "pull_request" ]]; then
+            echo "fetch_depth=$(($PR_COMMITS + 2))" >> $GITHUB_OUTPUT
+            echo "branch=$PR_HEAD_REF" >> $GITHUB_OUTPUT
           fi
 
       - name: Auto-pass in merge queue

From f8c1b98bc0acd035fcd026231852777f5922443d Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Thu, 30 Apr 2026 11:54:15 -0400
Subject: [PATCH 08/12] Update README with workflow descriptions

---
 README.md | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 912a559..c2ce0c7 100644
--- a/README.md
+++ b/README.md
@@ -6,9 +6,17 @@ Public AppSec tooling from Gemini's security engineering team, adapted for use i
 
 This repository contains security workflows, scanners, and automation tools for securing Gemini's open source projects.
 
-## Tools
+## Workflows
 
-_Tools will be added here as they are published._
+### Semgrep OSS
+[`.github/workflows/semgrep.yml`](.github/workflows/semgrep.yml)
+
+Runs [Semgrep](https://semgrep.dev) static analysis on pull requests and on a weekly schedule. Uses community rulesets (`p/default`, `p/security-audit`, `p/owasp-top-ten`) with no Semgrep account or token required. Findings are uploaded to GitHub Code Scanning.
+
+### Scan for Secrets
+[`.github/workflows/scan-for-secrets.yml`](.github/workflows/scan-for-secrets.yml)
+
+Scans pull requests for verified secrets using [TruffleHog](https://github.com/trufflesecurity/trufflehog). Only reports verified findings to minimize noise. No token or license required.
 
 ## Contributing
 

From 6680067186fcfe667214ed531532db8375723f1b Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Thu, 30 Apr 2026 12:50:02 -0400
Subject: [PATCH 09/12] Semgrep: pin image digest, switch to semgrep scan with
 --config=auto, continue-on-error

---
 .github/workflows/semgrep.yml | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 22cc147..c66a323 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -15,7 +15,7 @@ jobs:
     name: public
     runs-on: ubuntu-latest
     container:
-      image: semgrep/semgrep
+      image: semgrep/semgrep@sha256:5af6730dceda25a5ce80d068832b26c16d295ee1fc14b38667159fcdeeb7c9b8
     permissions:
       contents: read
       security-events: write  # Required for SARIF upload to GitHub Code Scanning
@@ -29,15 +29,10 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Run Semgrep OSS
-        # Runs in CI mode: diff-aware on PRs, full scan on push/schedule.
-        # No SEMGREP_APP_TOKEN = fully OSS/local mode; no data leaves the runner.
-        # SEMGREP_RULES sets the community rulesets to apply.
-        run: semgrep ci --sarif --output=semgrep.sarif
-        env:
-          SEMGREP_RULES: >-
-            p/default
-            p/security-audit
-            p/owasp-top-ten
+        # Full scan on every run. No token required; no data leaves the runner.
+        # --config=auto selects rules based on the languages detected in the repo.
+        run: semgrep scan --sarif --output=semgrep.sarif --config=auto
+        continue-on-error: true
 
       - name: Upload findings to GitHub Code Scanning
         uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18

From ee402d3990f2e542b3bc4eb250f8be73f9359046 Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Thu, 30 Apr 2026 12:51:20 -0400
Subject: [PATCH 10/12] Fix semgrep container image pin to correct 1.161.0
 digest from Docker Hub

---
 .github/workflows/semgrep.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index c66a323..7d7416c 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -15,7 +15,7 @@ jobs:
     name: public
     runs-on: ubuntu-latest
     container:
-      image: semgrep/semgrep@sha256:5af6730dceda25a5ce80d068832b26c16d295ee1fc14b38667159fcdeeb7c9b8
+      image: semgrep/semgrep:1.161.0@sha256:326e5f41cc972bb423b764a14febbb62bbad29ee1c01820805d077dd868fea48
     permissions:
       contents: read
       security-events: write  # Required for SARIF upload to GitHub Code Scanning

From 5814ba22e59e8b49c86604c5f1efd122ecaded96 Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Thu, 30 Apr 2026 12:56:20 -0400
Subject: [PATCH 11/12] Remove redundant if: always() now that
 continue-on-error is set

---
 .github/workflows/semgrep.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 7d7416c..3ffbdba 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -36,8 +36,6 @@ jobs:
 
       - name: Upload findings to GitHub Code Scanning
         uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
-        # Upload even on scan failure so findings are visible in the Security tab
-        if: always()
         with:
           sarif_file: semgrep.sarif
           category: semgrep-oss

From bb9b0153d38adf4a8c5bd6c54b1e3763636e6e29 Mon Sep 17 00:00:00 2001
From: Mantej Rajpal <mantej.rajpal@gemini.com>
Date: Thu, 30 Apr 2026 17:01:32 -0400
Subject: [PATCH 12/12] Split semgrep ci (PR diff-aware) vs semgrep scan
 (scheduled full scan)

---
 .github/workflows/semgrep.yml | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 3ffbdba..bbc8857 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -28,9 +28,16 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Run Semgrep OSS
-        # Full scan on every run. No token required; no data leaves the runner.
-        # --config=auto selects rules based on the languages detected in the repo.
+      - name: Run Semgrep OSS (diff-aware)
+        # PR scan: diff-aware via semgrep ci, only surfaces new findings against the merge base.
+        # No SEMGREP_APP_TOKEN = fully local mode; no data leaves the runner.
+        if: github.event_name == 'pull_request'
+        run: semgrep ci --sarif --output=semgrep.sarif --config=auto
+        continue-on-error: true
+
+      - name: Run Semgrep OSS (full scan)
+        # Scheduled/manual scan: full repo scan via semgrep scan.
+        if: github.event_name != 'pull_request'
         run: semgrep scan --sarif --output=semgrep.sarif --config=auto
         continue-on-error: true