From b52809325eccd69ccdfadfcd8e2c42432a64e68e Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 8 Oct 2026 11:42:05 +0100
Subject: [PATCH] ci: remove per-repo Semgrep scan; the Semgrep Code app covers
 PRs

The semgrep-code-hyperpolymath GitHub App (Semgrep Managed Scans) already
reports semgrep-cloud-platform/scan on every pull request here, so this
workflow scanned the same code twice. No Semgrep context is required by
any ruleset. actions.lock loses only the Semgrep-specific entries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013aSu89DNALjTYHBvA6FcoM
---
 .github/workflows/semgrep.yml | 33 ---------------------------------
 1 file changed, 33 deletions(-)
 delete mode 100644 .github/workflows/semgrep.yml

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
deleted file mode 100644
index 0f5c390..0000000
--- a/.github/workflows/semgrep.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-name: Semgrep SAST
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-    branches: [main, master]
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-permissions:
-  actions: read
-  contents: read
-jobs:
-  semgrep:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      security-events: write
-      contents: read
-    container:
-      image: semgrep/semgrep
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Run Semgrep
-        run: semgrep scan --sarif --output=semgrep.sarif --config=auto .
-        env:
-          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
-      - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v3.28.1
-        with:
-          sarif_file: semgrep.sarif
-        if: always()