ci: Initial run of Semgrep scan

[adimoft]

This pull request introduces several improvements and refactorings, primarily focused on Windows-specific code in cmd/app/tray_windows.go and CI workflow enhancements. The Windows code now consistently uses the golang.org/x/sys/windows package instead of the standard syscall package, improving maintainability and future compatibility. Additionally, new CI workflows are added and existing ones are refined.

Windows code refactoring and modernization:

• Refactored all Windows system calls in tray_windows.go to use the golang.org/x/sys/windows package instead of the deprecated syscall package, including DLL and procedure loading, UTF16 string handling, and error types. This affects mutex handling, message box display, and process attributes. [1] [2] [3] [4] [5]
• Updated error handling and type checks to match the new package, and clarified constant definitions for error codes and access rights. [1] [2] [3]

CI/CD workflow improvements:

• Added a new .github/workflows/semgrep.yml workflow to run Semgrep security scans on pushes and pull requests to the main branch, increasing code security and compliance.
• Enabled manual triggering (workflow_dispatch) for the main CI workflow in .github/workflows/ci.yml.
• Improved the release workflow in .github/workflows/release.yml by refining how branches are passed to semantic-release and correcting output handling.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.44%. Comparing base (9671bd3) to head (c15c02c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1084   +/-   ##
=======================================
  Coverage   43.44%   43.44%           
=======================================
  Files         143      143           
  Lines       13621    13621           
=======================================
  Hits         5917     5917           
  Misses       7143     7143           
  Partials      561      561           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Adds an initial Semgrep scanning workflow to the repository and includes a few workflow and Windows tray-related tweaks.

Changes:

• Added a new GitHub Actions workflow to run Semgrep on pushes/PRs.
• Updated the Windows tray single-instance logic to use golang.org/x/sys/windows APIs.
• Adjusted CI/release workflows (added workflow_dispatch; tweaked semantic-release invocation/output handling).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
cmd/app/tray_windows.go	Switches Win32 interop from syscall to x/sys/windows; refactors mutex and browser-launch code.
.github/workflows/semgrep.yml	Introduces a Semgrep scan workflow using a pinned container image and reusable action.
.github/workflows/release.yml	Updates the dry-run semantic-release step environment variable usage and output redirection quoting.
.github/workflows/ci.yml	Adds YAML document marker and enables manual dispatch.

[sudhir-intc]

@adimoft : can you please resolve the copilot review comments

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[sudhir-intc]

Changes LGTM.
@MadhaviLosetty : Please have a look at these changes.
@adimoft : How did you test your changes ?

[adimoft]

Changes LGTM. @MadhaviLosetty : Please have a look at these changes. @adimoft : How did you test your changes ?

I just implemented the Semgrep workflow, added some small corrections to ci.yml and after running the semgrep scan there were 3 findings some in release.yml and some in tray_windows.go. I created then some patch-set commits for fixing the Semgrep findings. This is all I done.

[madhavilosetty-intel]

@adimoft Thanks for putting these changes together.

A couple of small asks:

Can we restore the doc comments on the instance/mutex helpers? The difference between OpenMutexW and CreateMutexW, especially with the re-exec flow, is not obvious at first glance. I think those comments are useful context for future readers.

Also, for release.yml, it looks like the only required change is adding the quoting around >> "$GITHUB_OUTPUT" and the branch variable. The GITHUB_REF_NAME rename and splitting out the branch flag seem unrelated to this fix. Can we drop those changes to keep this PR focused?

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.