Add Semgrep SAST workflow, pin CI actions, document security

- Add semgrep.yml caller for the shared reusable SAST workflow
- Pin checkout/setup-python (@v2 -> v4/v5 SHAs) across all jobs
- Add Security section and Features bullet to README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: stremovsky

.github/workflows/ci.yml

@@ -15,10 +15,10 @@ jobs:
         python-version: [3.9, '3.10']
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ matrix.python-version }}
 
@@ -38,10 +38,10 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.10'
 
@@ -64,10 +64,10 @@ jobs:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.10'
 

.github/workflows/semgrep.yml

@@ -0,0 +1,22 @@
+# Caller: scans THIS repo using the shared reusable Semgrep workflow in databunker-devops.
+# Ruleset = Python language pack + the common security packs (see semgrep-reusable.yml).
+name: semgrep
+
+on:
+  workflow_dispatch:        # manual "Run workflow" button in the Actions tab
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "13 7 * * 1"    # weekly full sweep (Mon 07:13 UTC) — offset from gitleaks (06:27)
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  sast:
+    name: sast              # display + required-check name
+    uses: securitybunker/databunker-devops/.github/workflows/semgrep-reusable.yml@main
+    with:
+      config: "p/python p/secrets p/security-audit p/owasp-top-ten"

README.md

@@ -62,6 +62,7 @@ print(f"Created token in uuid format: {token_result['tokenuuid']}")
 - System Statistics
 - Type hints and comprehensive documentation
 - Error handling and validation
+- Continuous security scanning (Semgrep SAST, pinned CI actions)
 
 ## Development
 
@@ -83,6 +84,26 @@ pip install -e ".[dev]"
 pytest
 ```
 
+## Security
+
+This library is scanned on every push and pull request, with a weekly scheduled sweep to catch drift:
+
+- **SAST (Semgrep):** static analysis using the `p/python`, `p/secrets`, `p/security-audit`, and `p/owasp-top-ten` rulesets. A finding fails the check, and results are published to the repository's **Code Scanning** tab. See [`.github/workflows/semgrep.yml`](.github/workflows/semgrep.yml).
+- **Supply-chain hardening:** every GitHub Action is pinned to a full commit SHA, so a mutable tag (`@v4`) cannot be silently repointed to malicious code.
+
+Reproduce the SAST scan locally:
+
+```bash
+pip install semgrep
+semgrep scan \
+    --config p/python \
+    --config p/secrets \
+    --config p/security-audit \
+    --config p/owasp-top-ten
+```
+
+To report a security vulnerability, please email hello@databunker.org rather than opening a public issue.
+
 ## Contributing
 
 Contributions are welcome! Please feel free to submit a Pull Request.