ci: Update semgrep job

Author: sdn4z

.github/workflows/security.yml

@@ -23,9 +23,17 @@ jobs:
     runs-on: ubuntu-latest
     if: "!startsWith(github.event.head_commit.message, 'bump:')"
     container:
-      image: returntocorp/semgrep:latest
+      image: returntocorp/semgrep:1.128.1@sha256:fca58525689355641019c05ab49dcc5bc3a1eb7e044f35014ee39594b5aa4fc1
     steps:
       - uses: actions/checkout@v4
+      - name: Cache Python files
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.1
+        with:
+          path: ~/.cache/semgrep
+          key: semgrep-${{ runner.os }}
+          retention-days: 30
+          restore-keys: |
+            semgrep-${{ runner.os }}
       - name: Run Semgrep
         run: |
-          semgrep scan --config auto
+          semgrep scan --config auto --error

eval/cli.py

@@ -6,7 +6,7 @@
 
 from eval.classified_articles import NON_RELEVANT_ARTICLES, RELEVANT_ARTICLES
 from eval.constants import DEFAULT_EVAL_CONFIG_SECTION
-from eval.evaluator import eval
+from eval.evaluator import evaluate
 from eval.utils import EvalConfig, EvalFileConfig
 
 
@@ -68,7 +68,7 @@ def run(
         }
     )
 
-    eval(
+    evaluate(
         score_threshold=eval_config.score_threshold,
         relevant_articles=RELEVANT_ARTICLES,
         non_relevant_articles=NON_RELEVANT_ARTICLES,

eval/evaluator.py

@@ -10,7 +10,7 @@
 logger = logging.getLogger("eval")
 
 
-def eval(
+def evaluate(
     prompt: str,
     score_threshold: int,
     relevant_articles: set[Article],

tests/eval/test_cli.py

@@ -8,7 +8,7 @@
 
 
 class TestEvalCli:
-    @patch("eval.cli.eval")
+    @patch("eval.cli.evaluate")
     @patch("eval.cli.load_dotenv")
     @patch("eval.cli.EvalFileConfig.get_config_from_file")
     @patch("eval.cli.PromptConfig.get_config_from_file")
@@ -36,7 +36,7 @@ def test_env_file_parameter(self, m_prompt: Mock, m_config: Mock, m_load_dotenv:
         assert result.exit_code == 0
         assert m_load_dotenv.call_args == call("custom.env")
 
-    @patch("eval.cli.eval")
+    @patch("eval.cli.evaluate")
     @patch("eval.cli.load_dotenv")
     @patch("eval.cli.EvalFileConfig.get_config_from_file")
     @patch("eval.cli.PromptConfig.get_config_from_file")