[SEC-6012] Enabling code scanning via Semgrep and triage via claude

[randall-wyatt]

SEC-6012

Description

• Enables the code analysis workflow via Semgrep and triaging via claude

[cruhland]

This repo is very infrequently modified so it's not a big issue, but github.ref is the unique name of the branch that triggered the CI workflow. For pull_request events that's what you want, but for push events you typically don't want later commits to the main branch to cancel jobs running on earlier commits. Take a look at the bazel-ci.yml workflow in the BE repo for an alternative.

[cruhland]

Instead of needing to duplicate this CI workflow in many repos, have you looked into reusable GitHub Actions workflows? You can define them once, in a specific repo, and then "call" them from workflows in other repos. Search for kube-e2e in the Iterable GitHub organization for examples.

Or, you could even define an Action that can be used in any of our repos, like our existing security-custom-action or launchpad-publish-image-action.

Either way, it would mean that you'd only need to make a tiny stub workflow in each repo that has minimal configuration.

[cruhland]

Let's not check in dead code. Either remove these lines if they're not going to be used, or uncomment them.