From 2c821ecf61641de19b1cbacc805fa5120d3bf684 Mon Sep 17 00:00:00 2001
From: Anderson Leite <anderson.leite@movingimage.com>
Date: Mon, 27 Jul 2026 19:11:51 +0100
Subject: [PATCH 1/2] ci: security scan on Bedrock backend (drop explicit
 backend; inherit org default) [DSO-66]

---
 .github/workflows/security-scan.yaml | 34 ++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 .github/workflows/security-scan.yaml

diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml
new file mode 100644
index 0000000..901a7a6
--- /dev/null
+++ b/.github/workflows/security-scan.yaml
@@ -0,0 +1,34 @@
+# Security Scan
+#
+# Runs Semgrep (SAST -> Semgrep Cloud) and, on pull requests, an AI Security
+# Review that consolidates the Semgrep SARIF + a Trivy/Grype dependency scan +
+# a security-persona review of the diff, posts inline + summary comments and a
+# Check Run, and gates the merge on Critical/High findings.
+#
+# Secrets (via `secrets: inherit`): SEMGREP_APP_TOKEN, AWS_BEARER_TOKEN_BEDROCK.
+# Make "Security Scan / ai-security-review" a required check to block merges.
+# Reusable workflow: aminitech/.github/.github/workflows/reusable-security-scan.yaml
+name: Security Scan
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: ["main"]
+  push:
+    branches: ["main"]
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    uses: aminitech/.github/.github/workflows/reusable-security-scan.yaml@main
+    permissions:
+      contents: read
+      pull-requests: write
+      checks: write
+      security-events: write
+    with:
+      gate-threshold: high
+    secrets: inherit

From a57c828ac18562f024ae20fd5f38c36bb6648498 Mon Sep 17 00:00:00 2001
From: Anderson Leite <rootkit@gmail.com>
Date: Wed, 29 Jul 2026 08:53:38 +0100
Subject: [PATCH 2/2] ci: bump reusable-security-scan pin to v1.2.0

---
 .github/workflows/security-scan.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml
index 901a7a6..14f8e05 100644
--- a/.github/workflows/security-scan.yaml
+++ b/.github/workflows/security-scan.yaml
@@ -23,7 +23,7 @@ concurrency:
 
 jobs:
   scan:
-    uses: aminitech/.github/.github/workflows/reusable-security-scan.yaml@main
+    uses: aminitech/.github/.github/workflows/reusable-security-scan.yaml@c73bbc0f764e7e33c9ab65b4d9c617ee7f370e6a # v1.2.0
     permissions:
       contents: read
       pull-requests: write