Add PSScriptAnalyzer and OpenGrep security workflows

.github/workflows/opengrep.yml

@@ -0,0 +1,88 @@
+name: "OpenGrep"
+
+# OpenGrep is an LGPL 2.1 fork of Semgrep CE, backed by a consortium of
+# AppSec vendors. It is rule-compatible with Semgrep, so existing rule packs
+# (p/security-audit, p/javascript, p/typescript, p/github-actions) work
+# unchanged. See https://opengrep.dev for project details.
+#
+# This workflow currently runs on workflow_dispatch only while we evaluate
+# the tool's effectiveness for the Maester codebase. If results are valuable,
+# add push/pull_request triggers in a follow-up PR.
+
+permissions: {}
+
+on:
+  workflow_dispatch:
+    inputs:
+      opengrep_version:
+        description: 'OpenGrep release tag to install (e.g. v1.21.0). Leave blank for latest.'
+        required: false
+        default: 'v1.21.0'
+      config:
+        description: 'Rule config(s) to run (space- or comma-separated).'
+        required: false
+        default: 'p/security-audit p/javascript p/typescript p/github-actions'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  scan:
+    name: Scan with OpenGrep
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # Install OpenGrep by downloading the signed release binary directly
+      # from GitHub Releases (pinned by tag). Avoids piping a moving
+      # `install.sh` into bash, which would weaken supply-chain integrity.
+      - name: Install OpenGrep
+        env:
+          OPENGREP_VERSION: ${{ inputs.opengrep_version }}
+        run: |
+          set -euo pipefail
+          version="${OPENGREP_VERSION:-v1.21.0}"
+          asset="opengrep_manylinux_x86"
+          base="https://github.com/opengrep/opengrep/releases/download/${version}"
+          echo "Downloading OpenGrep ${version} (${asset})"
+          curl -fsSL --retry 3 -o /tmp/opengrep "${base}/${asset}"
+          chmod +x /tmp/opengrep
+          sudo mv /tmp/opengrep /usr/local/bin/opengrep
+          opengrep --version
+
+      - name: Run OpenGrep scan
+        id: scan
+        continue-on-error: true
+        env:
+          OPENGREP_CONFIG: ${{ inputs.config }}
+        run: |
+          set -euo pipefail
+          # Build a bash array of --config flags from the space/comma-separated
+          # input so values are passed as discrete argv entries (no
+          # word-splitting surprises).
+          args=()
+          normalized="${OPENGREP_CONFIG//,/ }"
+          for cfg in ${normalized}; do
+            args+=(--config "${cfg}")
+          done
+          opengrep scan \
+            "${args[@]}" \
+            --sarif \
+            --sarif-output=results.sarif \
+            --error \
+            --no-suppress-errors \
+            .
+
+      - name: Upload SARIF results
+        if: always() && hashFiles('results.sarif') != ''
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        with:
+          sarif_file: results.sarif
+          category: opengrep

.github/workflows/psscriptanalyzer.yml

@@ -0,0 +1,59 @@
+name: "PSScriptAnalyzer"
+
+permissions: {}
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - '**/*.ps1'
+      - '**/*.psm1'
+      - '**/*.psd1'
+      - '**/*.ps1xml'
+      - '.github/workflows/psscriptanalyzer.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - '**/*.ps1'
+      - '**/*.psm1'
+      - '**/*.psd1'
+      - '**/*.ps1xml'
+      - '.github/workflows/psscriptanalyzer.yml'
+  schedule:
+    - cron: '28 13 * * 2'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analyze:
+    name: Analyze PowerShell
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # Scans the entire repository recursively. PSScriptAnalyzer only
+      # analyzes files with PowerShell extensions (.ps1, .psm1, .psd1, .ps1xml),
+      # so non-PowerShell content under powershell/, tools/, build/, etc. is
+      # automatically ignored. This avoids per-directory invocations and
+      # transparently picks up any future PowerShell files added to the repo.
+      - name: Run PSScriptAnalyzer
+        uses: microsoft/psscriptanalyzer-action@6b2948b1944407914a58661c49941824d149734f # v1.1
+        with:
+          path: .
+          recurse: true
+          output: results.sarif
+
+      - name: Upload SARIF results
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        with:
+          sarif_file: results.sarif
+          category: psscriptanalyzer