ci: route lint-semgrep through install.sh + uv-managed pipx:semgrep (three-way-parity per Aaron 2026-04-27)#653

Merged

AceHack merged 5 commits intomainfrom

acehack/scorecard-pin-semgrep-docker-2026-04-27

Apr 27, 2026

Commits on Apr 27, 2026

ci: run lint-semgrep via SHA-pinned semgrep/semgrep Docker image (resolves Scorecard PinnedDependenciesID #17 #18)

AceHack
and
claude
committed
ci/setup: pin elan + mise installers by content hash (resolves Scorecard PinnedDependenciesID #15 #16)

AceHack
and
claude
committed
ci: switch semgrep to mise-managed pipx:semgrep (three-way-parity per Aaron 2026-04-27)

AceHack
and
claude
committed
ci: drop redundant pipx pin, bump uv to 0.11.8; document uv-canonical decision (Aaron 2026-04-27)

AceHack
and
claude
committed
ci/setup: address review feedback on #653 (cleanup traps, armv7, role-refs, stale comment)

AceHack
and
claude
committed