From 6cac3ac1105727f7a1a75b72c9ccb6e9a314273d Mon Sep 17 00:00:00 2001
From: Christian Joergensen <christian@technobabble.dk>
Date: Thu, 13 Aug 2026 06:07:31 -0400
Subject: [PATCH] ci: run Semgrep from PyPI and upload the report

---
 .github/workflows/security-daily.yml | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/security-daily.yml b/.github/workflows/security-daily.yml
index ee6f0f3..26ef4f2 100644
--- a/.github/workflows/security-daily.yml
+++ b/.github/workflows/security-daily.yml
@@ -38,13 +38,27 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.13"
+
+      - name: Install Semgrep
+        run: python -m pip install semgrep==1.171.0
+
       - name: Run Semgrep
-        uses: returntocorp/semgrep-action@v1
+        run: |
+          semgrep scan \
+            --config p/golang \
+            --config p/security-audit \
+            --error \
+            --sarif --output semgrep.sarif
+
+      - name: Upload SARIF
+        if: always() && hashFiles('semgrep.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
         with:
-          config: >-
-            p/golang
-            p/security-audit
-          generateSarif: "1"
+          sarif_file: semgrep.sarif
 
   gosec:
     name: "gosec: Full Scan"