feat: import Semgrep SAST findings to Cloud

[mldangelo-oai]

Summary

Adds --provider semgrep for Semgrep Code JSON and SARIF, including native Semgrep PRO output. Users can preview selected SAST findings, confirm publication, and repeat imports through the existing publisher. Stacked on #1689.

Behavior

Uses native fingerprints when available and a deterministic rule/path/range identity for Community Edition findings. Native SARIF %SRCROOT% paths preserve literal percent characters; direct URI paths are decoded once. Equivalent JSON and SARIF locations share their fallback identity. Moving a Community Edition finding changes that identity. Unresolved artifact indexes and custom bases remain unmapped; fingerprinted findings retain their evidence, while CE findings without a usable identity are excluded.

Requires --source-repository-url to identify the source and match the selected Cloud repository. GitHub and Enterprise matching preserves scheme and explicit-port distinctions. Saved requests continue to use the immutable repository identity during retries.

Retains selected original evidence, locations, snippets, ignored state, and source severity. Rejects incomplete scans, ambiguous duplicate identities, and unsupported products. Imported claims remain unassessed. Scan-wide path inventories and timing data are excluded from individual evidence.

Validation

• 411 focused tests across seven adapter/publication suites passed, including native percent paths, JSON/SARIF identity parity, repository matching, retries, and readback.
• Fifteen pinned public reports yielded 18 accepted findings, one expected incomplete-report rejection, and two expected duplicate-identity rejections from upstream-masked fingerprints.
• Types, generated contracts, formatting, build, Python checks, and nine portable checks passed.
• The 650-entry package passed installed SDK, CLI, types, plugin lifecycle, and nested-worker smoke checks.
• Both full SDK runs (seeds 12345 and 1347274054) had 5,305 passes, 75 skips, and one installed-hook test failure also reproduced on unchanged main. There were no other failures; these local runs are not reported as fully green.
• Three fresh native reviews and an independent verifier found no actionable introduced issues in this exact diff.

Hosted CI must qualify this updated head. Live Semgrep tenant testing remains pending; this qualification uses public fixtures. Semgrep JSON/SARIF documentation.

Compatibility

Cloud must support the semgrep provider before publication is available. This change does not enable rollout gates, start scans, or fetch report URLs.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[alandelong-oai]

Thanks for the focused integration. Owner-level merge-safety review: no material findings. The Semgrep adapter reuses the existing publication flow, preserves original scanner evidence and retry identity, and checks repository provenance before creating fresh requests. The stated CE identity and incomplete-format limitations match the implementation. Preserve the #1689 stack merge order.

All 64 Semgrep adapter cases and the GitHub import regression pass locally. An independent compiled-SDK check accepted 24 findings across 23 upstream reports and rejected the incomplete report; types, formatting, builds and public CLI/API checks pass. The identical tested-merge CI reports pass all 383 affected adapter/publication tests. Local durable publication is limited by the existing filesystem-ownership guard, and package validation encounters an unchanged launcher-mode constraint; neither is counted as a local full pass. No live Semgrep tenant or Cloud publication was exercised.