[rnegron]

Problem

• Every code PR and queue gate waits on semgrep-devex, usually the slowest Security job (queue p50 10.2 min, Oct 15 to 29).
• On a typical gate, a whole-tree pass that never fails takes 5m36s, and the ERROR pass 3m21s.

Changes

• The informational WARNING pass runs on master only. PRs already block new warnings in pass 3.
• The ERROR pass uses the semgrep-ci action, like semgrep-python: changed files on a PR, the whole tree on master.
• A devex rule or ci-security.yaml edit still scans the whole tree.
• Rules match within one file and master passes the full scan, so unchanged files keep master's result.

How did you test this code?

Test rationale: no new test.

• semgrep --x-ls lists the same 40,127 targets for the old and new ERROR pass, run locally.
• Code change: job 3m05s, ERROR pass 31s.
• ERROR violation in a changed file: blocked.
• Devex rule edit: whole-tree scan.

Release status

• No feature flag controls this change

Docs update

• None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Opus 5.5 (claude-opus-5-5)

Skills: /authoring-ci-workflows, /writing-pr-descriptions

More context for AI agents

• Decisions: reuse the semgrep-ci action rather than add diff logic to the job.
• Follow-ups: measure semgrep-devex on the queue path after merge.
• Read closely: the --include list, which must keep the old positional targets.

[trunk-io]

Merging to master in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[hosthog]

HostHog preview — posthog-desktop-web

The previews for this PR have been torn down and no longer serve.

[github-actions]

🤖 CI report

🚨 Trunk lane — universal lane

This PR is assigned to the universal lane. It cannot merge in parallel with other PRs, so it can take longer to merge. Ask dev-ex if you think this is wrong.

[parameterai]

Risk: No findings

This increment adds a concurrency group to the Security workflow (push runs keyed by SHA, PR runs keyed by ref with cancel-in-progress), drops the nonexistent services/hogql-language-service paths from the Go filter, and gives semgrep-test-rules a sparse checkout limited to .semgrep/, .github/workflows/, .gitignore, and .gitattributes. I found no new security issue in these changes: cancellation cannot bypass a required check (a cancelled run fails branch protection and every push starts a fresh run), the removed Go path no longer exists in the tree, and the sparse checkout still contains everything semgrep --test .semgrep/ and the workflow scan read (there is no root .semgrepignore, and all rule fixtures live under .semgrep/). The SHA-to-mutable-tag action changes visible in the since-last-review diff are pre-existing on the PR base (git show pr-base:.github/workflows/ci-security.yaml already has actions/checkout@v6.0.2 with the nosemgrep annotation), so this PR does not introduce them.

_{Sentinel reviewed f29ca30 · Review settings}

[posthog-security-review-bot]

✅ Security review complete — ae33a5161cfb

No findings above the confidence threshold, in 6 min.

_{Add the security-review label to run again on the latest commit.}

[posthog-security-review-bot]

Agent-driven security review - no findings.