From cd9a7092c83ed171dec432c23c214a27c0ca38c4 Mon Sep 17 00:00:00 2001
From: Hrushikesh Deshpande
 <161167942+hrushikeshdeshpande@users.noreply.github.com>
Date: Fri, 3 Apr 2026 09:30:19 -0400
Subject: [PATCH 1/3] update semgrep using full commit sha

---
 .github/workflows/semgrep.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 6087184..342be90 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -2,13 +2,12 @@ on:
   pull_request: {}
   schedule:
     - cron: '0 0 * * 6'
-name: Semgrep CE scan test
 jobs:
   semgrep:
     name: semgrep-oss
     runs-on: ubuntu-latest
     container:
-      image: semgrep/semgrep
+      image: semgrep/semgrep@sha256:500acf49f5e5785aa89af609b983f0427ac8cd08f7e34146277df6cffb002759 # v1.157.0
     steps:
-      - uses: actions/checkout@v5
-      - run: semgrep scan --config=auto
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
+      - run: semgrep scan --config=a

From cd19a8c2deaba56f2c99f843d1be5a95f142b3d7 Mon Sep 17 00:00:00 2001
From: Hrushikesh <hrushikesh@cloudflare.com>
Date: Fri, 3 Apr 2026 09:34:37 -0400
Subject: [PATCH 2/3] fix

---
 .github/workflows/semgrep.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 342be90..9f0d784 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -9,5 +9,6 @@ jobs:
     container:
       image: semgrep/semgrep@sha256:500acf49f5e5785aa89af609b983f0427ac8cd08f7e34146277df6cffb002759 # v1.157.0
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
-      - run: semgrep scan --config=a
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.B0
+      - run: semgrep scan --config=auto
+

From f5bc136a520a383007996f5b6e73417d99e171f6 Mon Sep 17 00:00:00 2001
From: Hrushikesh <hrushikesh@cloudflare.com>
Date: Tue, 21 Apr 2026 15:47:33 -0400
Subject: [PATCH 3/3] another fix

---
 .github/workflows/semgrep.yml | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 9f0d784..324c5e2 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -2,13 +2,18 @@ on:
   pull_request: {}
   schedule:
     - cron: '0 0 * * 6'
+concurrency:
+  group: semgrep-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+permissions:
+  contents: read
 jobs:
   semgrep:
     name: semgrep-oss
-    runs-on: ubuntu-latest
-    container:
-      image: semgrep/semgrep@sha256:500acf49f5e5785aa89af609b983f0427ac8cd08f7e34146277df6cffb002759 # v1.157.0
+    runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.B0
-      - run: semgrep scan --config=auto
-
+      - uses: actions/checkout@v5
+        with:
+          python-version: '3.11'
+      - run: pip install semgrep==1.157.0
+      - run: semgrep scan --config=auto
\ No newline at end of file