From 26721cff543befdb6ae0e0831a0a506a18f83eb7 Mon Sep 17 00:00:00 2001
From: Garrett Beatty <gcbeatty@amazon.com>
Date: Fri, 28 Aug 2026 12:42:18 -0400
Subject: [PATCH] chore: remove Semgrep scan (CodeQL remains as SAST)

---
 .github/workflows/semgrep-analysis.yml | 50 --------------------------
 1 file changed, 50 deletions(-)
 delete mode 100644 .github/workflows/semgrep-analysis.yml

diff --git a/.github/workflows/semgrep-analysis.yml b/.github/workflows/semgrep-analysis.yml
deleted file mode 100644
index 7a05b54bd..000000000
--- a/.github/workflows/semgrep-analysis.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-name: Semgrep
-
-on:
-  # Scan changed files in PRs, block on new issues only (existing issues ignored)
-  pull_request:
-
-  push:
-    branches: ["master"]
-
-  schedule:
-    - cron: '23 20 * * 1'
-
-  # Manually trigger the workflow
-  workflow_dispatch:
-
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  semgrep:
-    name: Scan
-    permissions:
-      contents: read # to check out the repository
-      security-events: write # to upload SARIF results to the code scanning dashboard
-    runs-on: ubuntu-latest
-    container:
-      image: returntocorp/semgrep@sha256:06938c1f365d3f67b8cedd8bc117607ae64253f88a0e768e9da9408548927dd6 # latest
-    # Skip any PR created by dependabot to avoid permission issues
-    if: (github.actor != 'dependabot[bot]')
-    steps:
-      # Fetch project source
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - run: semgrep ci --sarif > semgrep.sarif
-        env:
-          SEMGREP_RULES: >- # more at semgrep.dev/explore
-            p/security-audit
-            p/secrets
-            p/owasp-top-ten
-
-      - name: Upload SARIF file for GitHub Advanced Security Dashboard
-        uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98  # v4.32.6
-        with:
-          sarif_file: semgrep.sarif
-        if: always()