From 23df795e3023ebd0a966019aabadb02da4f88ce8 Mon Sep 17 00:00:00 2001
From: Nathan Xavier Golez <89695588+neeythann@users.noreply.github.com>
Date: Mon, 13 Jul 2026 00:58:47 +0000
Subject: [PATCH 1/3] ci: add semgrep scan on PRs to main

---
 .github/workflows/semgrep.yml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 .github/workflows/semgrep.yml

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
new file mode 100644
index 0000000..783fb8c
--- /dev/null
+++ b/.github/workflows/semgrep.yml
@@ -0,0 +1,25 @@
+name: Semgrep
+
+# Free/OSS Semgrep scan (no Semgrep AppSec Platform token) on every pull
+# request targeting main.
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  semgrep:
+    name: Semgrep scan
+    runs-on: ubuntu-latest
+    container:
+      image: semgrep/semgrep
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run Semgrep
+        run: semgrep scan --config p/golang --config p/secrets --error

From 46f07d9adbae247e10746f41b77e2e2f0a2dd94d Mon Sep 17 00:00:00 2001
From: Nathan Xavier Golez <89695588+neeythann@users.noreply.github.com>
Date: Mon, 13 Jul 2026 01:03:18 +0000
Subject: [PATCH 2/3] ci: pin semgrep image to 1.169.0

---
 .github/workflows/semgrep.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 783fb8c..16f5bbd 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -16,7 +16,7 @@ jobs:
     name: Semgrep scan
     runs-on: ubuntu-latest
     container:
-      image: semgrep/semgrep
+      image: semgrep/semgrep:1.169.0
     steps:
       - name: Checkout
         uses: actions/checkout@v4

From f2b6d3755542c06b6edb3a83421884612b456a23 Mon Sep 17 00:00:00 2001
From: Nathan Xavier Golez <89695588+neeythann@users.noreply.github.com>
Date: Mon, 13 Jul 2026 01:07:51 +0000
Subject: [PATCH 3/3] fix: suppress semgrep math/rand warning in hostname
 generation

---
 pkg/deploy/hostname.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkg/deploy/hostname.go b/pkg/deploy/hostname.go
index 921f85b..5ef9012 100644
--- a/pkg/deploy/hostname.go
+++ b/pkg/deploy/hostname.go
@@ -2,7 +2,9 @@ package deploy
 
 import (
 	"fmt"
-	"math/rand"
+	// Non-crypto randomness is fine here: generated instance names are scoped
+	// to the user's own account and are not global identifiers.
+	"math/rand" // nosemgrep: go.lang.security.audit.crypto.math_random.math-random-used
 	"regexp"
 )