ci: remove retired Semgrep action

[hyperpolymath]

Scope

Removes the two direct returntocorp/semgrep-action@v1 jobs from .github/workflows/security-policy.yml, updates only their dependent summary references, and removes the exact stale action and workflow mapping from .github/workflows/actions.lock.

Validation

• Required secret scans passed for every workflow/lock file before inspection, and again for the two edited files.
• YAML syntax parsing passed.
• rg confirms no remaining returntocorp/semgrep-action reference under .github/workflows.
• gh actions-lock --no-fix scanned 29 workflows; it reported only existing mise tool-registry/cache warnings, with no actions-lock finding.
• git diff --check passed.

Deliberately not changed

No Actions allowlists, repository rules, branch/tag protection, or unrelated workflow findings were changed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b304bb76-d2bf-46a2-b1ea-ff97c4b16c23

📥 Commits

Reviewing files that changed from the base of the PR and between 5ec5e9f and 3656400.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• .github/workflows/security-policy.yml

💤 Files with no reviewable changes (1)

• .github/workflows/security-policy.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (22)

• GitHub Check: Rust Tests
• GitHub Check: Cargo test
• GitHub Check: Integration Tests
• GitHub Check: governance / Validate Hypatia Baseline
• GitHub Check: Generate SBOM
• GitHub Check: Rust Dependency Audit
• GitHub Check: stress-test
• GitHub Check: Build AsciiDoc
• GitHub Check: E2E — Rust CLI Scan
• GitHub Check: Container Security (Trivy) (deploy/Containerfile)
• GitHub Check: Rust Dependency Audit
• GitHub Check: analyze (actions, none)
• GitHub Check: Generate Rust SBOM
• GitHub Check: criterion + baseline gate
• GitHub Check: analyze (javascript-typescript, none)
• GitHub Check: k9iser manifest + build
• GitHub Check: Build Rust - x86_64-apple-darwin
• GitHub Check: Build Rust - aarch64-unknown-linux-gnu
• GitHub Check: Build Rust - x86_64-pc-windows-msvc
• GitHub Check: Build Rust - x86_64-unknown-linux-gnu
• GitHub Check: Build Rust - aarch64-apple-darwin
• GitHub Check: Build AsciiDoc

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Removed Semgrep security scanning and audit checks from the security workflow.
  • Updated security status reporting to reflect the streamlined checks.

Walkthrough

The security workflow removes the primary and audit Semgrep jobs. It also removes their dependencies and status output entries. CodeQL remains the only SAST job described in the workflow.

Changes

Security workflow

Layer / File(s)	Summary
Remove Semgrep jobs .github/workflows/security-policy.yml	The workflow removes the primary and audit Semgrep jobs.
Update status reporting .github/workflows/security-policy.yml	Security status and audit summaries no longer depend on or report Semgrep results.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 36564

This localized change removes retired Semgrep workflow jobs and stale lockfile references without altering unrelated repository controls; no actionable merge-blocking risk remains after normal checks and review.

Poem

A rabbit checked the workflow lines

Semgrep leaves, while CodeQL shines
Status tables now agree
Audit paths run clean and free
Hop, hop, fewer jobs to see

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarises the main change: removal of the retired Semgrep action.
Description check	✅ Passed	The description directly explains the Semgrep action removal, dependent workflow updates, lock-file change, validation, and scope limits.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}