Add Semgrep SAST workflow, pin CI actions, document security

.github/workflows/maven.yml

@@ -29,10 +29,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
-    
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
     - name: Set up JDK 11
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
         java-version: '11'
         distribution: 'temurin'

.github/workflows/semgrep.yml

@@ -0,0 +1,22 @@
+# Caller: scans THIS repo using the shared reusable Semgrep workflow in databunker-devops.
+# Ruleset = Java language pack + the common security packs (see semgrep-reusable.yml).
+name: semgrep
+
+on:
+  workflow_dispatch:        # manual "Run workflow" button in the Actions tab
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "13 7 * * 1"    # weekly full sweep (Mon 07:13 UTC) — offset from gitleaks (06:27)
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  sast:
+    name: sast              # display + required-check name
+    uses: securitybunker/databunker-devops/.github/workflows/semgrep-reusable.yml@main
+    with:
+      config: "p/java p/secrets p/security-audit p/owasp-top-ten"

README.md

@@ -23,6 +23,7 @@ A Java client library for interacting with the DatabunkerPro API. DatabunkerPro
 - Thread-safe implementation
 - Comprehensive test suite
 - Enhanced error handling
+- Continuous security scanning (Semgrep SAST, pinned CI actions)
 
 ## Requirements
 
@@ -160,6 +161,7 @@ PatchOperation[] patchOps = {
     new PatchOperation("add", "/profile/age", 25)
 };
 Map<String, Object> patchResult = api.patchUser("email", "user@example.com", patchOps, null);
+```
 
 ### App Data Management
 
@@ -273,6 +275,26 @@ JitPack automatically builds and publishes your GitHub repository as a Maven dep
 
 3. **Check build status** at: https://jitpack.io/#securitybunker/databunkerpro-java
 
+## Security
+
+This library is scanned on every push and pull request, with a weekly scheduled sweep to catch drift:
+
+- **SAST (Semgrep):** static analysis using the `p/java`, `p/secrets`, `p/security-audit`, and `p/owasp-top-ten` rulesets. A finding fails the check, and results are published to the repository's **Code Scanning** tab. See [`.github/workflows/semgrep.yml`](.github/workflows/semgrep.yml).
+- **Supply-chain hardening:** every GitHub Action is pinned to a full commit SHA, so a mutable tag (`@v4`) cannot be silently repointed to malicious code.
+
+Reproduce the SAST scan locally:
+
+```bash
+pip install semgrep
+semgrep scan \
+    --config p/java \
+    --config p/secrets \
+    --config p/security-audit \
+    --config p/owasp-top-ten
+```
+
+To report a security vulnerability, please email hello@databunker.org rather than opening a public issue.
+
 ## Contributing
 
 1. Fork the repository