Sync feature/nest-zappa-migration with main

.codecov.yml

@@ -0,0 +1,55 @@
+codecov:
+  require_ci_to_pass: true
+
+comment:
+  layout: reach, diff, flags, files, footer
+  behavior: default
+  require_changes: false
+
+coverage:
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1%
+        base: auto
+      backend:
+        flags:
+          - backend
+        target: 80%
+        threshold: 1%
+        base: auto
+      frontend:
+        flags:
+          - frontend
+        target: 80%
+        threshold: 1%
+        base: auto
+    patch:
+      default:
+        target: auto
+        threshold: 0%
+      backend:
+        flags:
+          - backend
+        target: auto
+        threshold: 0%
+      frontend:
+        flags:
+          - frontend
+        target: auto
+        threshold: 0%
+
+fixes:
+  - /app/::frontend/
+  - /home/owasp/::backend/
+
+flags:
+  backend:
+    paths:
+      - backend/
+    carryforward: true
+  frontend:
+    paths:
+      - frontend/
+    carryforward: true

.github/dependabot.yml

@@ -40,6 +40,11 @@ updates:
     schedule:
       interval: daily
 
+  - package-ecosystem: docker
+    directory: /docker/semgrep
+    schedule:
+      interval: daily
+
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/workflows/check-pr-issue.yaml

@@ -15,8 +15,10 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      # NOSEMGREP: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          # Explicitly checking out base branch (target repository), not PR code.
           ref: ${{ github.event.pull_request.base.sha }}
 
       - name: Check PR linked issue and assignee