add semgrep and action canges

[fabiohysollari]

No description provided.

[github-actions]

🤖 AI Analysis (PR Agent by TechDebtGPT)

📋 Summary

Summary

What: Adds Semgrep integration and updates action configuration with significant refactoring of the PR agent workflow and CLI commands.

Why: Introduces static code analysis capabilities (5 critical fixes mentioned) and improves the codebase structure through workflow and command refactoring.

Impact: Core files affected include the base PR agent workflow, analyze command, compiled action distribution files, and expanded README documentation (+163 lines).

💡 Quick Actions

1. 🔴 .github/workflows/pr-analyzer.yml:22 - CRITICAL [AI]
   Security Issue: API keys are being exposed as environment variables without proper validation....

2. 🔴 dist/action.js:49 - CRITICAL [AI]
   Critical Bug: Incomplete code in diff - the summary variable assignment is truncated....

3. 🔴 README.md:581 - CRITICAL [AI]
   Security Documentation Issue: The README shows how to configure multiple API keys but doesn't warn about the security risks per the repository's o...

4. 🔴 dist/cli/commands/config.command.js:undefined - CRITICAL [AI]
   Security Issue: Based on the security analysis, this file handles configuration with potential command injection vulnerabilities through the `--se...

5. 🔴 .github/workflows/pr-analyzer.yml:undefined - CRITICAL [AI]
   Security Issue: Potential hardcoded credentials detected. Use environment variables or a secrets manager instead of hardcoding sensitive values.

6. 🟡 - WARNING [AI]
   🟡 Warning: Implement Secure API Key Management: Refactor the workflow and CLI to use GitHub Secrets exclusively for API keys instead of environment variables...

7. 🔴 - CRITICAL [AI]
   🔴 Critical: Fix Critical Truncation Bug in dist/action.js: Complete the truncated summary variable assignment at line 49 in the compiled distribution file. ...

8. 🟡 - WARNING [AI]
   🟡 Warning: Add Input Validation for Semgrep Integration: Implement schema validation for the new Semgrep configuration parameters in the PR analyzer workflow...

3 more issues found.

---

Total tokens used: 34,580