Add ci and semgrep actions (#3)

## PRs in the Stack
- ➡ #3

(The stack is managed by
[git-grok](https://github.com/dimikot/git-grok).)

.github/workflows/ci.yml

@@ -0,0 +1,25 @@
+name: "CI Full Run"
+on:
+ pull_request:
+ branches:
+ - main
+ - grok/*/*
+ push:
+ branches:
+ - main
+jobs:
+ test:
+ runs-on: ubuntu-latest
+ strategy:
+ matrix:
+ node-version: ["20.x"]
+ steps:
+ - uses: actions/checkout@v4
+ - name: Use Node.js ${{ matrix.node-version }}
+ uses: actions/setup-node@v3
+ with:
+ node-version: ${{ matrix.node-version }}
+ - run: npm install
+ - run: npm run build
+ - run: npm run test
+ - run: npm run lint

.github/workflows/semgrep.yml

@@ -0,0 +1,36 @@
+# Name of this GitHub Actions workflow.
+name: Semgrep
+
+on:
+ # Scan changed files in PRs (diff-aware scanning):
+ pull_request:
+ branches: ['main']
+
+ # Schedule the CI job (this method uses cron syntax):
+ schedule:
+ - cron: '0 0 * * MON-FRI'
+
+jobs:
+ semgrep:
+ # User definable name of this GitHub Actions job.
+ name: Scan
+ # If you are self-hosting, change the following `runs-on` value:
+ runs-on: ubuntu-latest
+
+ container:
+ # A Docker image with Semgrep installed. Do not change this.
+ image: returntocorp/semgrep@sha256:6c7ab81e4d1fd25a09f89f1bd52c984ce107c6ff33affef6ca3bc626a4cc479b
+
+ # Skip any PR created by dependabot to avoid permission issues:
+ if: (github.actor != 'dependabot[bot]')
+
+ steps:
+ # Fetch project source with GitHub Actions Checkout.
+ - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ # Run the "semgrep ci" command on the command line of the docker image.
+ - run: semgrep ci
+ env:
+ # Connect to Semgrep Cloud Platform through your SEMGREP_APP_TOKEN.
+ # Generate a token from Semgrep Cloud Platform > Settings
+ # and add it to your GitHub secrets.
+ SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}