Add TPM MLDSA authentication for post quantum TLS 1.3 with example and tests #136

	name: Semgrep

	on:
	push:
	branches: [ 'master', 'main', 'release/**' ]
	pull_request:
	branches: [ '*' ]
	types: [opened, synchronize, reopened, ready_for_review]

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	semgrep:
	name: Semgrep (wolfTPM security rules)
	if: github.event_name != 'pull_request' \|\| github.event.pull_request.draft == false
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-python@v5
	with:
	python-version: '3.12'

	# Pin Semgrep so the gate is deterministic: a future release cannot
	# change rule behavior or fail the build out from under a PR.
	- name: Install Semgrep
	run: pip install --quiet semgrep==1.166.0

	# --error makes the job fail on any finding. The rules self-scope via
	# their `paths:` blocks, so scanning the whole tree is fine.
	- name: Run wolfTPM security rules
	run: semgrep scan --config .github/semgrep-rules.yml --error --quiet .

Provide feedback