From 000c4736b433fb71b61e4c11e5120d3b677aa7d1 Mon Sep 17 00:00:00 2001
From: Claude Code Bot <claude-code@smartwatermelon.github>
Date: Wed, 21 Oct 2026 19:45:20 -0700
Subject: [PATCH 1/2] fix(semgrep): add the push trigger to the README caller
 example

The README setup example lacked the push-to-main trigger that
semgrep/caller-stub.yml gained in #198. Add it, and a test that the
example's triggers match the stub's.

Advances smartwatermelon/dev-env#166.
---
 README.md                  |  2 ++
 tests/test-semgrep-scan.sh | 11 +++++++++++
 2 files changed, 13 insertions(+)

diff --git a/README.md b/README.md
index f8e94e5..e6ac140 100644
--- a/README.md
+++ b/README.md
@@ -704,6 +704,8 @@ name: Semgrep Scan
 on:
   pull_request:
   workflow_dispatch:
+  push:
+    branches: [main]
 permissions:
   contents: read
 jobs:
diff --git a/tests/test-semgrep-scan.sh b/tests/test-semgrep-scan.sh
index fa3bedf..cfb9bd3 100755
--- a/tests/test-semgrep-scan.sh
+++ b/tests/test-semgrep-scan.sh
@@ -111,5 +111,16 @@ else
   _bad "caller stub names changed"
 fi
 
+# 10. the README setup example has the stub's triggers
+stub_on="$(awk '/^on:$/{f=1} /^permissions:$/{f=0} f && !/^ *#/' "${stub_file}")"
+readme_on="$(awk '/^## `semgrep-scan.yml`$/{m=1} m && /^### Setup$/{s=1}
+  s && /^```yaml$/{y=1; next} y && /^```$/{exit}
+  y && /^on:$/{f=1} y && /^permissions:$/{f=0} f' "${readme}")"
+if [[ -n "${stub_on}" && "${stub_on}" == *"push:"* && "${stub_on}" == "${readme_on}" ]]; then
+  _ok "README setup example has the caller stub's triggers"
+else
+  _bad "trigger drift: stub='${stub_on}' README='${readme_on}'"
+fi
+
 echo "${pass} passed, ${fail} failed"
 [[ "${fail}" -eq 0 ]]

From dd335f30a312d19360034a2f66a9d93dc2420b57 Mon Sep 17 00:00:00 2001
From: Claude Code Bot <claude-code@smartwatermelon.github>
Date: Wed, 21 Oct 2026 19:46:09 -0700
Subject: [PATCH 2/2] test(semgrep): skip comment lines in the README trigger
 extraction

Match the stub side, so a comment in the README example does not
read as trigger drift.
---
 tests/test-semgrep-scan.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test-semgrep-scan.sh b/tests/test-semgrep-scan.sh
index cfb9bd3..1b76424 100755
--- a/tests/test-semgrep-scan.sh
+++ b/tests/test-semgrep-scan.sh
@@ -115,7 +115,7 @@ fi
 stub_on="$(awk '/^on:$/{f=1} /^permissions:$/{f=0} f && !/^ *#/' "${stub_file}")"
 readme_on="$(awk '/^## `semgrep-scan.yml`$/{m=1} m && /^### Setup$/{s=1}
   s && /^```yaml$/{y=1; next} y && /^```$/{exit}
-  y && /^on:$/{f=1} y && /^permissions:$/{f=0} f' "${readme}")"
+  y && /^on:$/{f=1} y && /^permissions:$/{f=0} f && !/^ *#/' "${readme}")"
 if [[ -n "${stub_on}" && "${stub_on}" == *"push:"* && "${stub_on}" == "${readme_on}" ]]; then
   _ok "README setup example has the caller stub's triggers"
 else