ci: run Semgrep from PyPI and upload the report

[chrj]

returntocorp/semgrep-action@v1 is deprecated. Semgrep archived it, so it takes no fixes and no new rules.

The scan runs from PyPI now, the way vanguard already runs it: set up Python, install a pinned Semgrep, then call semgrep scan.

The results were going nowhere

The old step asked for SARIF with generateSarif: "1", and no step ever uploaded it. The file was written inside the runner and thrown away with it, so nothing reached the Security tab of this repository, and the security-events: write permission went unused.

There is an upload step now, guarded so it runs only when the scan wrote a file:

- name: Upload SARIF
  if: always() && hashFiles('semgrep.sarif') != ''
  uses: github/codeql-action/upload-sarif@v4

always() matters: --error makes Semgrep exit non-zero when it finds something, which is exactly when the report is worth reading.

Pins

Semgrep is pinned to 1.171.0 and Python to 3.13, the versions vanguard runs. A scanner that moves on its own turns a green run red with no change from you.

The actions stay pinned to tags, as the rest of this repository pins them.