From 4add24e54526b8f647bdfbe94729a1304f4c00c2 Mon Sep 17 00:00:00 2001
From: Stefan Fleckenstein <stefan@fleckenstein.co.uk>
Date: Tue, 30 Jun 2026 16:41:50 +0100
Subject: [PATCH 1/3] chore: add semgrep to pre-commits

---
 .pre-commit-config.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 239c27d2..458b3007 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -41,6 +41,15 @@ repos:
     hooks:
       - id: hadolint
 
+  - repo: https://github.com/semgrep/pre-commit
+    rev: deab6d496da5b26298b2937aca9a221506cf3a65 # 1.168.0
+    hooks:
+      - id: semgrep
+        verbose: true
+        args: ['--config', 'p/typescript', '--skip-unknown-extensions', '--disable-version-check']
+        files: \.(ts|tsx|js|jsx|mjs|cjs)$
+        exclude: ^e2e/
+
   - repo: local
     hooks:
       - id: npm-lint

From 5f5895d26da0235a00366854a18abc45e0ba9c83 Mon Sep 17 00:00:00 2001
From: Stefan Fleckenstein <stefan@fleckenstein.co.uk>
Date: Tue, 30 Jun 2026 16:42:42 +0100
Subject: [PATCH 2/3] fix: add stages

---
 .pre-commit-config.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 458b3007..3b983f8e 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -47,6 +47,7 @@ repos:
       - id: semgrep
         verbose: true
         args: ['--config', 'p/typescript', '--skip-unknown-extensions', '--disable-version-check']
+        stages: [pre-commit, pre-merge-commit]
         files: \.(ts|tsx|js|jsx|mjs|cjs)$
         exclude: ^e2e/
 

From a7e144dd2454d99c30560a62680d7d799ca38fd1 Mon Sep 17 00:00:00 2001
From: Stefan Fleckenstein <stefan@fleckenstein.co.uk>
Date: Tue, 30 Jun 2026 17:46:58 +0100
Subject: [PATCH 3/3] fix: updated settings for semgrep hook

---
 .pre-commit-config.yaml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3b983f8e..b41fc00f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -45,8 +45,16 @@ repos:
     rev: deab6d496da5b26298b2937aca9a221506cf3a65 # 1.168.0
     hooks:
       - id: semgrep
-        verbose: true
-        args: ['--config', 'p/typescript', '--skip-unknown-extensions', '--disable-version-check']
+        require_serial: true
+        args:
+          [
+            '--config',
+            'p/typescript',
+            '--skip-unknown-extensions',
+            '--disable-version-check',
+            '--error',
+            '--quiet'
+          ]
         stages: [pre-commit, pre-merge-commit]
         files: \.(ts|tsx|js|jsx|mjs|cjs)$
         exclude: ^e2e/