From b82b8603035813b86d0106987bc5194097f3d5d6 Mon Sep 17 00:00:00 2001
From: Felipe <felipe_augustos84@outlook.com.br>
Date: Wed, 9 Sep 2026 12:09:33 -0300
Subject: [PATCH 1/3] ci: add Semgrep scanning and Dependabot version updates

Claude-Session: https://claude.ai/code/session_013t7KAEs6bL14h4JUjaK9Hu
---
 .github/dependabot.yml        | 14 ++++++++++++++
 .github/workflows/semgrep.yml | 36 +++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/semgrep.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ff7bd43
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      minor-and-patch:
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
new file mode 100644
index 0000000..426f388
--- /dev/null
+++ b/.github/workflows/semgrep.yml
@@ -0,0 +1,36 @@
+name: Semgrep
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "17 6 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    container:
+      image: semgrep/semgrep
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Semgrep scan
+        run: >
+          semgrep scan
+          --config p/default
+          --config p/python
+          --config p/secrets
+          --config p/github-actions
+          --sarif --output semgrep.sarif
+          --error
+
+      - name: Upload SARIF to code scanning
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: semgrep.sarif

From 5cd78377d659c70ea71276b6ed642cb999c8434f Mon Sep 17 00:00:00 2001
From: Felipe <felipe_augustos84@outlook.com.br>
Date: Wed, 9 Sep 2026 12:51:38 -0300
Subject: [PATCH 2/3] ci: report Semgrep findings without blocking, pin
 actions, add Dependabot cooldown

Claude-Session: https://claude.ai/code/session_013t7KAEs6bL14h4JUjaK9Hu
---
 .github/dependabot.yml        | 4 ++++
 .github/workflows/semgrep.yml | 8 ++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ff7bd43..11fc565 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     groups:
       minor-and-patch:
         update-types: [minor, patch]
@@ -12,3 +14,5 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 426f388..bc33652 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -5,9 +5,10 @@ on:
     branches: [main]
   pull_request:
   schedule:
-    - cron: "17 6 * * 1"
+    - cron: '17 6 * * 1'
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 
@@ -17,7 +18,7 @@ jobs:
     container:
       image: semgrep/semgrep
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Semgrep scan
         run: >
@@ -27,10 +28,9 @@ jobs:
           --config p/secrets
           --config p/github-actions
           --sarif --output semgrep.sarif
-          --error
 
       - name: Upload SARIF to code scanning
         if: always()
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
         with:
           sarif_file: semgrep.sarif

From ce9e95dc6d10fdc18ae84c2412a986f4a062738f Mon Sep 17 00:00:00 2001
From: Felipe <felipe_augustos84@outlook.com.br>
Date: Wed, 9 Sep 2026 13:13:59 -0300
Subject: [PATCH 3/3] ci: pin the Semgrep container image to a digest

Claude-Session: https://claude.ai/code/session_013t7KAEs6bL14h4JUjaK9Hu
---
 .github/workflows/semgrep.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index bc33652..98c03a0 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -16,7 +16,7 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     container:
-      image: semgrep/semgrep
+      image: semgrep/semgrep:1.176.1@sha256:34ab619bf1391a24bfda3f05debd0d8a6ce3093c2d5f9d39cfc00f83c1397823
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4