ci: add semgrep rules check in security-scanner plugins

.github/scan.hcl

@@ -40,13 +40,41 @@ repository {
     curl_bash     = true
   }
 
+  plugin "codeql" {
+    languages = ["go"]
+  }
+
+  plugin "semgrep" {
+    use_git_ignore = true
+
+    exclude = [
+      "*_test.go",
+      "website/*",
+      "e2e/*",
+      "internal/testing/*",
+      "changelog/*",
+      "*.md",
+    ]
+
+    config = [
+      "p/gosec",                                                    # https://semgrep.dev/p/gosec
+      "p/r2c-security-audit",                                       # https://semgrep.dev/p/r2c-security-audit
+      "p/github-actions",                                           # https://semgrep.dev/p/github-actions
+      "r/trailofbits.go.hanging-goroutine.hanging-goroutine",       # https://semgrep.dev/p/trailofbits
+      "r/trailofbits.go.racy-append-to-slice.racy-append-to-slice", # https://semgrep.dev/p/trailofbits
+      "r/trailofbits.go.racy-write-to-map.racy-write-to-map",       # https://semgrep.dev/p/trailofbits
+      ".semgrep/",
+    ]
+  }
+
   # Triage items that are _safe_ to ignore here. Note that this list should be
   # periodically cleaned up to remove items that are no longer found by the scanner.
   triage {
     suppress {
       vulnerabilities = [
         "GO-2025-3543", // github.com/opencontainers/runc TODO(jrasell): remove once withdrawn from DBs.
       ]
+
       paths = [
         "ui/tests/*",
         "internal/testing/*",

.github/workflows/security-scan.yml

@@ -35,8 +35,18 @@ jobs:
     if: ${{ (github.repository != 'hashicorp/nomad' || (github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name))
       && (github.actor != 'dependabot[bot]') && (github.actor != 'hc-github-team-nomad-core') }}
 
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+            path: code
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: 3.x
       - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           cache: ${{ contains(runner.name, 'Github Actions') }}
@@ -51,11 +61,17 @@ jobs:
           path: security-scanner
           ref: main
 
+      - name: Install Security Scanner Semgrep Plugin Dependency
+        shell: bash
+        run: |
+          python3 -m pip install semgrep
+
       - name: Scan
         id: scan
         uses: ./security-scanner
         with:
-          repository: "$PWD"
+          repository: "code"
+          plugins: "codeql semgrep"
         env:
           SECURITY_SCANNER_CONFIG_FILE: .github/scan.hcl
           # See scan.hcl at repository .github location for config.