ci: add Semgrep OSS scanning workflow

[hrushikeshdeshpande]

Summary

Adds Semgrep Community Edition (OSS) scanning to this repository as part of the App&ProdSec team's migration from Semgrep Pro to Semgrep CE.

What it does

• Runs on every PR, on push to the main/master branch, and monthly on a staggered schedule.
• Uses actions/cache@v5 so pip install semgrep only runs on cold cache (first run, version bump, or 7-day idle).
• Pinned to semgrep==1.160.0 with --config=auto (default OSS ruleset).
• Runs on ubuntu-slim with contents: read token scope.

For reviewers

• Findings are informational; the job does not block on findings.
• First PR after merge installs Semgrep; subsequent PRs skip that step.

See the internal App&ProdSec email for migration context, or ping us internally.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	94.38%	740 / 784
🔵	Statements	94.32%	764 / 810
🔵	Functions	91.76%	156 / 170
🔵	Branches	86.71%	444 / 512

File Coverage

No changed files found.

Generated in workflow #683 for commit fdcba90 by the Vitest Coverage Report Action

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/chanfana@339

commit: fdcba90