[SEC-6012] Enabling code scanning via Semgrep and triage via claude

.github/workflows/code-scanning.yml

@@ -0,0 +1,184 @@
+name: "Code Analysis"
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: '0 0 * * 1' # Runs every Monday at midnight, this is to ensure that there is at least 1 scan every 7 days.
+
+  workflow_dispatch:
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze_scala:
+    name: Analyze Scala
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+      id-token: write
+      checks: read
+      pull-requests: write
+
+    container:
+      # A Docker image with Semgrep installed. Do not change this.
+      image: semgrep/semgrep
+
+    # Skip any PR created by dependabot to avoid permission issues:
+    if: (github.actor != 'dependabot[bot]')
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: 'false'
+
+      - name: Fetch forked ruleset
+        uses: actions/checkout@v4
+        with:
+          repository: 'Iterable/semgrep-rules'
+          path: .scala-security
+          sparse-checkout: 'scala'
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run Semgrep
+        run: semgrep scan --config .scala-security/scala --sarif --output semgrep.sarif
+
+      - name: Upload SARIF results to GitHub Code Scanning
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: semgrep.sarif
+          path: semgrep.sarif
+
+#  triage_sarif_file:
+#    name: Triage SARIF
+#    runs-on: gha-runner-bedrock
+#    permissions:
+#      security-events: write
+#      packages: read
+#      actions: read
+#      contents: read
+#      id-token: write
+#      checks: read
+#      pull-requests: write
+#    needs: analyze_scala
+#
+#    steps:
+#      - name: Checkout repo
+#        uses: actions/checkout@v4
+#        with:
+#          persist-credentials: 'false'
+#          fetch-depth: '0'
+#
+#      - name: Download SARIF artifact
+#        uses: actions/download-artifact@v4
+#        with:
+#          name: semgrep.sarif
+#
+#      - name: Setup Node.js
+#        uses: actions/setup-node@v4
+#        with:
+#          node-version: '24'
+#
+#      - name: Extract Pod Identity Credentials
+#        shell: bash
+#        run: |
+#          echo "Checking Pod Identity environment variables..."
+#          if [ -n "$AWS_CONTAINER_CREDENTIALS_FULL_URI" ] && [ -n "$AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE" ]; then
+#          echo "Pod Identity detected - fetching credentials..."
+#
+#          # Read the authorization token
+#          TOKEN=$(cat "$AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE")
+#
+#          # Fetch credentials from the Pod Identity agent
+#          CREDS=$(curl -s -f -H "Authorization: $TOKEN" "$AWS_CONTAINER_CREDENTIALS_FULL_URI" || exit 1)
+#          echo "$CREDS" | jq -e '.AccessKeyId' > /dev/null || exit 1
+#
+#          echo "Credentials response received"
+#
+#          # Extract credentials using jq
+#          ACCESS_KEY=$(echo "$CREDS" | jq -r '.AccessKeyId')
+#          SECRET_KEY=$(echo "$CREDS" | jq -r '.SecretAccessKey')
+#          SESSION_TOKEN=$(echo "$CREDS" | jq -r '.Token')
+#          echo "::add-mask::$ACCESS_KEY"
+#          echo "::add-mask::$SECRET_KEY"
+#          echo "::add-mask::$SESSION_TOKEN"
+#
+#          # Set as GitHub environment variables
+#          {
+#           echo "AWS_ACCESS_KEY_ID=$ACCESS_KEY"
+#           echo "AWS_SECRET_ACCESS_KEY=$SECRET_KEY"
+#           echo "AWS_SESSION_TOKEN=$SESSION_TOKEN"
+#           echo "AWS_DEFAULT_REGION=us-west-2"
+#           echo "AWS_REGION=us-west-2"
+#          } >> "$GITHUB_ENV"
+#
+#          echo "Pod Identity credentials extracted successfully"
+#          else
+#          echo "Pod Identity environment variables not found"
+#          fi
+#
+#      - name: Install Claude Code
+#        env:
+#          CLAUDE_CODE_USE_NODE: "true" # Forces it to skip downloading/using Bun
+#        run: |
+#          npm install -g --ignore-scripts @anthropic-ai/claude-code@2.1.202
+#
+#      - name: Run Triage
+#        uses: anthropics/claude-code-action@6867bb3ab0b2c0a10629b6823e457347e74ad6d2 # v1.0.43
+#        with:
+#          use_bedrock: "true"
+#          use_sticky_comment: "true"
+#          additional_permissions: "actions: read"
+#          github_token: ${{ secrets.GITHUB_TOKEN }}
+#          claude_args: |
+#            --model us.anthropic.claude-opus-4-5-20251101-v1:0
+#            --max-turns 45
+#          settings: |
+#            {
+#              "CLAUDE_CODE_ENABLE_TELEMETRY": "0"
+#            }
+#          prompt: |
+#            You are an expert AppSec Triage Agent. Your job is to analyze a Semgrep finding, review the surrounding source code, and calculate a strict "True Positive Confidence Score" (0.0 to 1.0). The file is semgrep.sarif.
+#
+#            Analyze the input based on these strict evaluation buckets:
+#            1. Data Flow (0.0 - 0.35): Is untrusted input reachable?
+#            2. Mitigations (0.0 - 0.25): Deduct points if validation, escaping, or defensive frameworks are used.
+#            3. Reachability (0.0 - 0.20): Is this live production code, an active endpoint, or a mock/test file?
+#            4. Rule Fit (0.0 - 0.20): Is the finding a genuine logic flaw or a superficial/syntactic match?
+#
+#            CRITICAL FILTERING RULE:
+#              - If the calculated `total_confidence_score` is LESS THAN 0.80 (80%), you MUST set the `triage_decision` to "REMOVE".
+#              - If the `total_confidence_score` is 0.80 or HIGHER, evaluate whether it is a "TRUE_POSITIVE".
+#
+#            You MUST return your answer in the following JSON format:
+#              {
+#                "analysis": {
+#                  "data_flow_notes": "string",
+#                  "mitigation_notes": "string",
+#                  "reachability_notes": "string"
+#                },
+#                "scores": {
+#                  "data_flow": 0.00,
+#                  "mitigations": 0.00,
+#                  "reachability": 0.00,
+#                  "rule_fit": 0.00
+#                },
+#                "total_confidence_score": 0.00,
+#                "triage_decision": "TRUE_POSITIVE" | "REMOVE"
+#              }
+#
+#      - name: Upload SARIF results to GitHub Code Scanning
+#        uses: github/codeql-action/upload-sarif@v4
+#        if: always()
+#        with:
+#          sarif_file: semgrep.sarif
+#          category: semgrep