Add Semgrep CI

.github/workflows/semgrep.yml

@@ -1,20 +1,24 @@
-name: Semgrep Scan
-
 on:
+  workflow_dispatch: {}
+  pull_request: {}
   push:
-    branches: [master]
-  pull_request:
-    branches: [master]
-
+    branches:
+    - main
+    - master
+    paths:
+    - .github/workflows/semgrep.yml
+  schedule:
+  # random HH:MM to avoid a load spike on GitHub Actions at 00:00
+  - cron: 36 3 * * *
+name: Semgrep
 jobs:
   semgrep:
-    runs-on: ubuntu-latest
+    name: semgrep/ci
+    runs-on: ubuntu-20.04
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+    container:
+      image: returntocorp/semgrep
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v3
-        with:
-          python-version: '3.x'
-      - name: Install Semgrep
-        run: pip install semgrep
-      - name: Run Semgrep
-        run: semgrep --config .semgrep.yml .
+    - uses: actions/checkout@v4
+    - run: semgrep ci