ci: add Semgrep SAST scanning on pull requests

[ulziibay-kernel]

Adds Semgrep static analysis on PRs to main via the reusable workflow in kernel/security-workflows. Includes .semgrepignore for generated code, test fixtures, and lock files.

Made with Cursor

---

Note

Low Risk
Low risk CI-only change that adds static analysis on PRs; the main risk is new PR check noise or false positives affecting developer workflow.

Overview
Adds a new GitHub Actions workflow (.github/workflows/semgrep.yml) that runs Semgrep on pull requests to main via the shared kernel/security-workflows reusable workflow, enabling the p/golang and p/trailofbits rulesets.

Introduces .semgrepignore to exclude dependencies/build output and other low-signal files (e.g., node_modules/, vendor/, dist/, *_test.go, go.sum) from scanning.

^{Reviewed by Cursor Bugbot for commit 9c774a2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR only modifies CI/security tooling configuration, not kernel API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9c774a2. Configure here.}

[cursor]

Generated Go files not excluded from scanning

Medium Severity

The .semgrepignore file doesn't actually exclude any of the repository's generated Go files, despite the PR description stating it covers generated code. Files like cmd/api/wire_gen.go (Wire), lib/guest/guest.pb.go and lib/guest/guest_grpc.pb.go (protobuf), lib/oapi/oapi.go, and lib/vmm/vmm.go (oapi-codegen) are all generated and marked with "DO NOT EDIT" but will still be scanned, likely producing false positives that create CI noise or block PRs.

 

^{Reviewed by Cursor Bugbot for commit 9c774a2. Configure here.}

[Sayan-]

LGTM — standard Semgrep reusable workflow rollout. Go configs and .semgrepignore look correct.