ci: gated pipeline (ci + CodeQL + Semgrep + Snyk)

[listepo]

Summary

One gated pipeline for this repo: ci, codeql, semgrep and snyk run in parallel, and a final gate job passes only when all four succeeded.

• .github/workflows/pipeline.yml (new): triggers on push to main, pull requests to main (opened / synchronize / reopened / ready_for_review), weekly on Monday (17 4 * * 1) and workflow_dispatch. Each job uses: ./.github/workflows/<name>.yml; secrets are passed explicitly (no secrets: inherit: snyk gets SNYK_TOKEN, ci only what ci.yml uses). Draft pull requests skip every job, gate included, so a draft run never leaves a green gate check behind; otherwise gate (needs: [ci, codeql, semgrep, snyk], if: always() + not-draft) fails unless every result is success (failure, cancelled and skipped all fail it). Future deploy/release jobs must needs: gate.
• ci.yml, codeql.yml, semgrep.yml: now on: workflow_call (+ workflow_dispatch, so gh workflow run ci.yml still works). Their own push / pull_request / schedule triggers are removed so nothing runs twice. Top-level concurrency groups that used github.workflow were renamed (ci) or dropped (codeql/semgrep): inside a called workflow github.workflow is the caller's name, so they would have collided with each other; pipeline.yml owns concurrency now. The ci job in the pipeline is granted actions: read, contents: read, pull-requests: write, the union of what ci.yml's jobs request (a called workflow cannot exceed the caller's grant).
• .github/workflows/snyk.yml (new): free Snyk CLI via SHA-pinned snyk/actions/setup, snyk test --all-projects --sarif-file-output=snyk.sarif (findings and scan errors never fail the job), snyk monitor --all-projects only on push to main, SARIF uploaded with category snyk. Uses repo secret SNYK_TOKEN; if it is missing the job emits a ::notice:: and succeeds.
• codeql.yml is taken from the ci/codeql branch; semgrep.yml from the ci/semgrep branch (identical content), both converted to reusable workflows; checkout/CodeQL actions in codeql.yml are SHA-pinned (Semgrep github-actions-mutable-action-tag).

This PR supersedes #14 (ci/codeql) #17 (ci/semgrep).

Snyk coverage

• Ecosystems detected: Cargo (Rust), pnpm/npm workspaces, Gradle Kotlin DSL (Android), Swift Package Manager (Package.resolved), CocoaPods (Podfile), pip (requirements.txt), Dockerfiles.
• pnpm/npm, SwiftPM and Gradle are attempted; pip needs its packages installed and CocoaPods needs Podfile.lock, so those may show as unresolved. Dockerfiles are not scanned (snyk container test needs built images).
• Rust/Cargo: per Snyk docs (docs.snyk.io → Supported languages → Rust) snyk test / snyk monitor do not support Cargo; Rust Open Source scanning is limited to snyk sbom test on a CycloneDX/SPDX SBOM (API use requires Ignite/Enterprise), and license scanning is unavailable for Cargo. Dart/Flutter (pub) is not supported by the Snyk CLI either.

Policy change

pipeline.yml runs ci.yml on push (including push to main) and on non-draft pull requests. This changes the previous policy that CI runs only via manual dispatch; Ivan asked for these triggers explicitly. Where ci.yml has a revert-on-failure job guarded by github.event_name == 'push', it now becomes active on pushes to main through the pipeline. Draft PRs no longer get CI until marked ready.

Verification

workflow_dispatch needs the workflow file on the default branch, so gh workflow run pipeline.yml --ref ci/pipeline returns 404 before merge; the pipeline is verified through the pull_request (ready_for_review) run on this PR's head. actionlint 1.7.12 (with shellcheck) passes on all five workflow files.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: listepo/cross-code/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 9b71fd6c-36dc-410f-a51b-c73107696e1e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}