Feature/msdks 2201 implement gh codeql

[horiastere]

Summary by CodeRabbit

• Security
  • Added automated Semgrep security scanning for Android, iOS, and Dart code.
  • Scans run on code changes, weekly, or manually and check for security issues, exposed secrets, and common vulnerabilities.
  • Scan results are uploaded to the repository’s Security dashboard for review.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: af82fb3d-bf11-47fe-bad4-ffec12382526

📥 Commits

Reviewing files that changed from the base of the PR and between e2c6587 and 99a2759.

📒 Files selected for processing (1)

• .github/workflows/semgrep.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds a GitHub Actions workflow that runs Semgrep scans for Android, iOS, and Dart code on repository events, weekly, or manually. Each job uploads SARIF findings to the GitHub Security tab.

Changes

Semgrep security scanning

Layer / File(s)	Summary
Workflow setup and platform scans .github/workflows/semgrep.yml	The workflow adds push, pull request, scheduled, and manual triggers. Separate jobs scan Android, iOS, and Dart targets with shared security rules and platform-specific rules where applicable. Each job uploads SARIF results with a distinct category.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 99a27

This PR adds a localized GitHub workflow file, and no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title identifies a GitHub security-scanning implementation, which matches the workflow changes. However, the workflow uses Semgrep rather than CodeQL, so the title is not fully precise.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/MSDKS-2201-implement-gh-codeql

---

_{Comment @coderabbitai help to get the list of available commands.}