Added Semgrep scanning

.github/workflows/application-build.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Checkout repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Generate version
       id: version
       run: |
@@ -29,19 +29,19 @@ jobs:
           echo "tag_version=$TAG_VERSION" >> $GITHUB_OUTPUT
           echo "COMMIT_SHORT_SHA=$SHORT_SHA" >> $GITHUB_ENV
     - name: Login to Google Artifact registry (Maven)
-      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
       with:
         service_account: ${{ env.MAVEN_SERVICE_ACCOUNT }}
         credentials_json: ${{ secrets.MAVEN_REGISTRY_JSON_KEY }}
         export_environment_variables: true
         create_credentials_file: true
     - name: Install Java
-      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         java-version: '25'
         distribution: 'temurin'
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884
+      uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
     - name: Build the extender-client.jar
       run: ./gradlew -PpublishToGar -PclientVersion=${{ steps.version.outputs.tag_version }} client:jar
     - name: Test the extender-client.jar
@@ -63,7 +63,7 @@ jobs:
             --target ${{ github.sha }} \
             ${{ github.workspace }}/gh_release/*.jar
     - name: Notify if tests failed
-      uses: homoluctus/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
+      uses: lazy-actions/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
       if: failure()
       with:
         type: ${{ job.status }}
@@ -76,7 +76,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Checkout repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Generate version
       id: version
       run: |
@@ -87,19 +87,19 @@ jobs:
           echo "tag_version=$TAG_VERSION" >> $GITHUB_OUTPUT
           echo "COMMIT_SHORT_SHA=$SHORT_SHA" >> $GITHUB_ENV
     - name: Login to Google Artifact registry (Maven)
-      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
       with:
         service_account: ${{ env.MAVEN_SERVICE_ACCOUNT }}
         credentials_json: ${{ secrets.MAVEN_REGISTRY_JSON_KEY }}
         export_environment_variables: true
         create_credentials_file: true
     - name: Install Java
-      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         java-version: '25'
         distribution: 'temurin'
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884
+      uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
     - name: Build manifestmerger
       run: ./gradlew -PpublishToGar -PmanifestMergetoolVersion=${{ steps.version.outputs.tag_version }} :manifestmergetool:mainJar
     - name: Test manifestmerger
@@ -121,7 +121,7 @@ jobs:
             --target ${{ github.sha }} \
             ${{ github.workspace }}/gh_release/*.jar
     - name: Notify if tests failed
-      uses: homoluctus/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
+      uses: lazy-actions/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
       if: failure()
       with:
         type: ${{ job.status }}
@@ -135,7 +135,7 @@ jobs:
     steps:
     # cleanup disk space because we use lots of disk space for Docker image during extender tests
     - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
+      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
       with:
         # this might remove tools that are actually needed,
         # if set to "true" but frees about 6 GB
@@ -150,7 +150,7 @@ jobs:
         docker-images: true
         swap-storage: true
     - name: Checkout repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Generate version
       id: version
       run: |
@@ -161,12 +161,12 @@ jobs:
           echo "tag_version=$TAG_VERSION" >> $GITHUB_OUTPUT
           echo "COMMIT_SHORT_SHA=$SHORT_SHA" >> $GITHUB_ENV
     - name: Install Java
-      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         java-version: '25'
         distribution: 'temurin'
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884
+      uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
     - name: Build extender
       run: ./gradlew -PextenderVersion=${{ steps.version.outputs.tag_version }} server:bootJar
     - name: Login to Google Artifact registry (Docker)
@@ -183,7 +183,7 @@ jobs:
     - name: Run extender tests
       run: ./gradlew -PextenderVersion=${{ steps.version.outputs.tag_version }} server:test -i
     - name: Login to Google Artifact registry (Maven)
-      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
       with:
         service_account: ${{ env.MAVEN_SERVICE_ACCOUNT }}
         credentials_json: ${{ secrets.MAVEN_REGISTRY_JSON_KEY }}
@@ -207,13 +207,13 @@ jobs:
             ${{ github.workspace }}/gh_release/*.jar
     - name: Upload test results
       if: always()
-      uses: actions/upload-artifact@v6.0.0
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: test-result
         path: ${{ github.workspace }}/server/build/reports/tests/
         retention-days: 10
     - name: Notify if tests failed
-      uses: homoluctus/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
+      uses: lazy-actions/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
       if: failure()
       with:
         type: ${{ job.status }}

.github/workflows/code-coverage.yml

@@ -10,23 +10,23 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Checkout repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Install Java
-      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         java-version: '25'
         distribution: 'temurin'
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884
+      uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
     - name: Run extender tests
       run: ./gradlew server:clean server:test server:jacocoTestReport -PexcludeTags="integration" -i
     - name: Setup .NET Core # Required to execute ReportGenerator
-      uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309
+      uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
       with:
         dotnet-version: 8.x
         dotnet-quality: 'ga'
     - name: ReportGenerator
-      uses: danielpalme/ReportGenerator-GitHub-Action@4c0f60daf67483745c34efdeadd4c4e78a19991e3
+      uses: danielpalme/ReportGenerator-GitHub-Action@ee0ae774f6d3afedcbd1683c1ab21b83670bdf8e # 5.5.1
       with:
         reports: '${{ github.workspace }}/server/build/reports/jacoco/test/jacocoTestReport.xml' # REQUIRED # The coverage reports that should be parsed (separated by semicolon). Globbing is supported.
         targetdir: 'coveragereport' # REQUIRED # The directory where the generated report should be saved.
@@ -48,13 +48,13 @@ jobs:
         toolpath: 'reportgeneratortool' # Default directory for installing the dotnet tool.
     - name: Upload test results
       if: always()
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: test-result
         path: ${{ github.workspace }}/server/build/reports/tests/
         retention-days: 10
     - name: Upload coverage report artifact
-      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: CoverageReport # Artifact name
         path: coveragereport # Directory containing files to upload

.github/workflows/docker-env-build.yml

@@ -118,7 +118,7 @@ jobs:
           ${{ steps.name_postprocess.outputs.target_registry }}/extender-${{ steps.name_postprocess.outputs.image_name }}-env:latest
 
     - name: Notify if tests failed
-      uses: homoluctus/slatify@master
+      uses: lazy-actions/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
       if: failure()
       with:
         type: ${{ job.status }}

.github/workflows/semgrep-scanning.yml

@@ -0,0 +1,31 @@
+name: Semgrep Code Scanning
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 2 * * MON"
+
+jobs:
+  semgrep_scan:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install Semgrep
+        run: |
+          python3 -m pip install semgrep
+
+      - name: Run Semgrep Scan
+        run: |
+          semgrep scan \
+            --config p/java \
+            --config p/security-audit \
+            --sarif \
+            --output semgrep-java-scan.sarif
+
+      - name: Upload SARIF to Code Scanning
+        uses: github/codeql-action/upload-sarif@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # 4.32.0
+        with:
+          sarif_file: semgrep-java-scan.sarif