Add Semgrep/ShellCheck SAST and Trivy scanning to CI

[Copilot]

Adds security scanning to CI, adapted from the SAST job in CanastaWiki/CanastaBase, plus a Trivy filesystem scan. Findings are published to the repository Security tab as SARIF rather than gating the build.

sast job

• Semgrep 1.170.1 (pinned, installed in a venv) with p/php over PHP files and p/security-audit over shell files, uploaded under categories semgrep-php and semgrep-shell.
• ShellCheck v0.10.0 (--shell=bash, severity error) over .github/scripts.
• Canasta's _sources target and wait-for-it.sh exclusion don't exist here, so scans target the repo root with --exclude vendor --exclude build, and ShellCheck uses scandir: ./.github/scripts.

trivy job

• scan-type: fs with vuln,secret,misconfig scanners, SARIF output limited to CRITICAL/HIGH/MEDIUM, exit-code: 0.

Conventions

• All actions pinned by commit SHA, matching the rest of ci.yml.
• Job-level security-events: write (workflow default remains contents: read).
• SARIF uploads use continue-on-error: true — fork PRs receive a read-only token and cannot upload.

Docs

• .github/CI-SETUP.md and .github/copilot-instructions.md describe the new jobs.

No extension.json bump: the version gate ignores hidden-path-only changes.

Note: Semgrep rulesets could not be exercised locally (semgrep.dev is unreachable from the sandbox), so the first CI run is the real check on rule output.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (3)

.github/workflows/ci.yml:137

• This SARIF upload step is expected to fail on fork PRs due to read-only tokens; with continue-on-error it won’t gate CI, but it still produces noisy auth errors. Add an if: guard to skip the upload for fork PRs so the job output stays clean and matches the docs’ “skipped silently” wording.

      - name: Upload Trivy results to GitHub Security
        continue-on-error: true
        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3

.github/workflows/ci.yml:97

• Same as above: this SARIF upload step will still run on fork PRs and emit auth-related errors/warnings (even though it won’t fail the job). Add an if: guard to skip the upload when the PR’s head repo isn’t this repository.

      - name: Upload shell Semgrep results to GitHub Security
        continue-on-error: true
        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3

.github/workflows/ci.yml:85

• The workflow documentation says SARIF uploads are skipped silently for fork PRs, but this step will still run (and typically log an auth error) on fork PRs even with continue-on-error. Add an explicit if: guard so the upload step is actually skipped when the PR comes from a different repository, reducing noise for contributors and aligning behavior with the docs.

This issue also appears in the following locations of the same file:

• line 95
• line 135

      - name: Upload Semgrep results to GitHub Security
        # Pull requests from forks only get a read-only token, so the upload cannot succeed there.
        continue-on-error: true
        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.