Live verification scoring + standalone score command #1080

	---
	name: Semgrep Analysis
	on:
	merge_group:
	pull_request:
	branches:
	- main
	types:
	- opened
	- synchronize
	- reopened
	push:
	branches:
	- main
	schedule:
	- cron: "0 0 * * *" # Run daily at midnight UTC

	concurrency:
	group: semgrep-${{ github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	permissions:
	actions: read
	checks: write
	contents: read
	pull-requests: write
	security-events: write

	jobs:
	semgrep:
	name: Semgrep Analysis
	runs-on: ubuntu-latest
	container:
	image: returntocorp/semgrep@sha256:98c2572fced2474539fd27cab3207ebd8e95e4e7aab4c3b381fdc5e2641d9941 # v1.160.0

	if: (github.actor != 'dependabot[bot]')

	steps:
	- name: Checkout git repository
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	token: ${{ secrets.GITHUB_TOKEN }}

	- name: Configure Git Safe Directory
	run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"

	- name: Semgrep Analysis
	env:
	SEMGREP_RULES: >-
	p/terraform
	p/github-actions
	p/golang
	p/python
	p/docker
	p/secrets
	p/security-audit
	p/owasp-top-ten
	p/supply-chain
	SEMGREP_TIMEOUT: 300
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	semgrep ci \
	--config="${SEMGREP_RULES}" \
	--timeout="${SEMGREP_TIMEOUT}" \
	--sarif --output=semgrep-results.sarif

	- name: Upload SARIF to GitHub Security
	if: always()
	uses: github/codeql-action/upload-sarif@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
	with:
	sarif_file: semgrep-results.sarif

Provide feedback