feat(security): add Semgrep scanner with python + secrets rulesets

.semgrepignore

@@ -0,0 +1,12 @@
+# Ignore test fixtures and generated files
+tests/eval/benchmark_dataset.py
+tests/load/
+*.pyc
+__pycache__/
+.venv/
+venv/
+node_modules/
+.git/
+dist/
+build/
+*.egg-info/

app/tools/semgrep_scanner.py

@@ -0,0 +1,94 @@
+import json
+import subprocess  # nosec B404
+from typing import Any
+
+from app.core.logger import get_logger
+
+logger = get_logger(__name__)
+
+# Rulesets to run. These are free, no login required.
+# p/python  — common Python bugs, anti-patterns, security issues
+# p/secrets — hardcoded credentials, tokens, keys
+SEMGREP_RULESETS = ["p/python", "p/secrets"]
+
+# Severity mapping from Semgrep's levels to our internal convention
+_SEVERITY_MAP = {
+    "ERROR":   "critical",
+    "WARNING": "high",
+    "INFO":    "medium",
+}
+
+
+def run_semgrep(local_path: str) -> dict[str, Any]:
+    """
+    Run Semgrep against local_path and return a normalised result dict.
+
+    Returns:
+        {
+            "success": bool,
+            "findings": [
+                {
+                    "rule_id": str,
+                    "severity": "critical" | "high" | "medium",
+                    "message": str,
+                    "file": str,
+                    "line": int,
+                }
+            ],
+            "error": str | None,
+        }
+    """
+    result: dict[str, Any] = {"success": False, "findings": [], "error": None}
+
+    try:
+        process = subprocess.run(  # nosec B603 B607
+            [
+                "semgrep",
+                "--config", ",".join(SEMGREP_RULESETS),
+                "--json",
+                "--quiet",
+                "--no-git-ignore",   # scan everything, not just tracked files
+                "--timeout", "60",
+                ".",
+            ],
+            cwd=local_path,
+            capture_output=True,
+            text=True,
+            timeout=90,
+        )
+
+        # Semgrep exits 1 when findings are present — that is NOT an error
+        if process.returncode not in (0, 1):
+            result["error"] = process.stderr[:500] if process.stderr else "semgrep exited with code " + str(process.returncode)
+            logger.warning("Semgrep exited unexpectedly", extra={"returncode": process.returncode, "stderr": result["error"]})
+            return result
+
+        raw = json.loads(process.stdout or "{}")
+        findings = []
+        for match in raw.get("results", []):
+            findings.append({
+                "rule_id":  match.get("check_id", "unknown"),
+                "severity": _SEVERITY_MAP.get(match.get("extra", {}).get("severity", "INFO"), "medium"),
+                "message":  match.get("extra", {}).get("message", "")[:300],
+                "file":     match.get("path", "unknown"),
+                "line":     match.get("start", {}).get("line", 0),
+            })
+
+        result["success"] = True
+        result["findings"] = findings
+        logger.info("Semgrep scan complete", extra={"findings": len(findings)})
+
+    except FileNotFoundError:
+        result["error"] = "semgrep not installed — skipping"
+        logger.warning("Semgrep not found on PATH — install with: pip install semgrep")
+    except subprocess.TimeoutExpired:
+        result["error"] = "semgrep timed out after 90s"
+        logger.warning("Semgrep scan timed out", extra={"path": local_path})
+    except json.JSONDecodeError as exc:
+        result["error"] = f"Failed to parse semgrep JSON output: {exc}"
+        logger.warning("Semgrep JSON parse error", extra={"error": str(exc)})
+    except Exception as exc:  # nosec B110
+        result["error"] = str(exc)
+        logger.warning("Semgrep scan failed", extra={"error": str(exc)})
+
+    return result

app/tools/static_analyzer.py

@@ -1,6 +1,8 @@
 import subprocess  # nosec B404
 from typing import Any
 
+from app.tools.semgrep_scanner import run_semgrep
+
 
 def run_ruff(local_path: str) -> dict[str, Any]:
     result: dict[str, Any] = {"output": "", "issues": [], "success": False}
@@ -43,10 +45,29 @@ def run_bandit(local_path: str) -> dict[str, Any]:
 
 
 def run_full_analysis(local_path: str) -> dict[str, Any]:
-    ruff_results = run_ruff(local_path)
+    ruff_results   = run_ruff(local_path)
     bandit_results = run_bandit(local_path)
+    semgrep_result = run_semgrep(local_path)
+
+    # Normalise Semgrep findings into the same flat issues list format
+    # used by ruff/bandit so callers don't need to know the difference
+    semgrep_issues = [
+        f"[{f['severity'].upper()}] {f['rule_id']} {f['file']}:{f['line']} — {f['message']}"
+        for f in semgrep_result.get("findings", [])
+    ]
+
     return {
-        "ruff": ruff_results,
-        "bandit": bandit_results,
-        "total_issues": len(ruff_results["issues"]) + len(bandit_results["issues"]),
-    }
+        "ruff":    ruff_results,
+        "bandit":  bandit_results,
+        "semgrep": {
+            "issues":   semgrep_issues,
+            "findings": semgrep_result.get("findings", []),  # structured form for downstream use
+            "success":  semgrep_result.get("success", False),
+            "error":    semgrep_result.get("error"),
+        },
+        "total_issues": (
+            len(ruff_results["issues"])
+            + len(bandit_results["issues"])
+            + len(semgrep_issues)
+        ),
+    }

requirements.txt

@@ -35,4 +35,6 @@ redis==5.0.8
 
 pip-audit==2.7.3
 
-locust==2.32.4
+locust==2.32.4
+
+semgrep>=1.70.0