ci: remove redundant workflow-based Semgrep runs

[mbiuki]

Summary

The Semgrep App (semgrep ci + SEMGREP_APP_TOKEN) is already installed and scans every PR, posting findings as PR comments. The workflow jobs were duplicating that work and adding unnecessary nodes to the needs dependency chains.

• Delete cicd_comp_semgrep-phase.yml entirely
• Remove semgrep: job from cicd_1-pr.yml; simplify finalize needs
• Remove disable-semgrep input and semgrep: job from cicd_3-trunk.yml; drop semgrep from deployment and finalize needs

Closes #36436

After merge (manual)

Remove these from repo Settings → Secrets and Variables:

• Secret: SEMGREP_APP_TOKEN
• Variable: DISABLE_SEMGREP
• Variable: SEMGREP_NO_FAIL

Test plan

• Verify CI passes on this PR (no Semgrep job should appear in the workflow run)
• Confirm the Semgrep App still posts scan results on the next PR after merge

[claude]

Claude finished @mbiuki's task in 1m 11s —— View job

---

Code Review

Reviewed the 3 changed workflow files against origin/main.

• Gather context (diff, cross-references)
• Verify no dangling references to the removed semgrep job
• Review needs chains for correctness

New Issues

No issues found.

Verification notes:

• cicd_comp_semgrep-phase.yml deletion is safe — grep across .github/**/*.yml finds zero remaining references to cicd_comp_semgrep-phase.yml, the semgrep job, SEMGREP_APP_TOKEN, or disable-semgrep/DISABLE_SEMGREP in any workflow.
• cicd_1-pr.yml: finalize.needs correctly narrowed from [semgrep, test] → [test]. Since the removed semgrep job itself declared needs: [initialize, build], dropping it doesn't orphan any upstream job — build is still reachable via test's chain.
• cicd_3-trunk.yml: semgrep removed from both deployment.needs and finalize.needs; the disable-semgrep dispatch input is also removed. No other job referenced needs.semgrep.* outputs, so no broken expressions remain.
• The finalize reusable workflow consumes needsData generically (toJson(needs)), so removing a key doesn't break it.
• Header comments were updated consistently to drop the "Semgrep analysis" phrasing.

Non-blocking (out of scope, not in this diff): WORKFLOW_ARCHITECTURE.md and README.md still document the Semgrep phase in their pipeline diagrams and secret lists. Worth a follow-up doc cleanup so the architecture docs don't drift, but not required for this PR.

The manual post-merge secret/variable cleanup (SEMGREP_APP_TOKEN, DISABLE_SEMGREP, SEMGREP_NO_FAIL) noted in the PR description is correct — those live in repo Settings and can't be removed via workflow files.

LGTM. ✅

[github-actions]

🤖 dotBot Review (Bedrock)

Reviewed 3 file(s); 0 candidate(s) → 0 confirmed, 0 uncertain (unverified, kept for review).

✅ No issues found after verification.

---

_{us.deepseek.r1-v1:0 · Run: #28812934094 · tokens: in: 10054 · out: 2470 · total: 12524 · calls: 4 · est. ~$0.027}

[mbiuki]

❌ Linked Issue Needs Team Label

This PR is linked to issue #36436, but that issue has no Team : * label. Every linked issue must be owned by a team for tracking and triage.

How to fix this:

Apply a Team : * label to the linked issue (e.g., Team : Scout, Team : Platform, Team : Falcon, Team : Maintenance). Then push a new commit or edit the PR description to re-run this check.

This comment was automatically generated by the issue linking workflow

fixed

[mergify]

Queued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-07 23:25 UTC · Rule: default · triggered by @mbiuki with the merge queue checkbox
• ❌ Checks failed · on draft merge queue: checking main (58bf0e1) and #36437 together #36465
• 🚫 Left the queue — 2026-07-08 00:18 UTC · at 582ff4b6962d128d5340518619c38141e1c29ae0

This pull request spent 53 minutes 4 seconds in the queue, including 52 minutes 47 seconds running CI.

Waiting for any of

• check-neutral = Finalize / Final Status
• check-skipped = Finalize / Final Status
• check-success = Finalize / Final Status

All conditions

• any of [🛡 GitHub branch protection]:
  • check-neutral = Finalize / Final Status
  • check-skipped = Finalize / Final Status
  • check-success = Finalize / Final Status
• #review-threads-unresolved = 0 [🛡 GitHub branch protection]
  • ci: remove redundant workflow-based Semgrep runs #36437
• github-review-approved [🛡 GitHub branch protection]
  • ci: remove redundant workflow-based Semgrep runs #36437
• github-review-decision = APPROVED [🛡 GitHub branch protection]
  • ci: remove redundant workflow-based Semgrep runs #36437
• any of [🛡 GitHub branch protection]:
  • check-success = Initialize / Initialize
  • check-neutral = Initialize / Initialize
  • check-skipped = Initialize / Initialize

Reason

The merge conditions cannot be satisfied due to failing checks

• Finalize / Final Status
• Initialize / Initialize

Failing checks:

• ❌ Finalize / Final Status (job log)

Hint

You may have to fix your CI before adding the pull request to the queue again.
If you update this pull request, to fix the CI, it will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue instead, you can requeue the pull request, without updating it, by posting a @mergifyio queue comment.

Tick the box to put this pull request back in the merge queue (same as @mergifyio queue).

• Requeue this pull request