Move Semgrep to CircleCI, add as release gate

.circleci/config.yml

@@ -112,6 +112,24 @@ jobs:
             python -m mypy .
             cd ..
           no_output_timeout: 10m
+
+  semgrep:
+    docker:
+      - image: cimg/python:3.12
+        auth:
+          username: ${DOCKERHUB_USERNAME}
+          password: ${DOCKERHUB_PASSWORD}
+    working_directory: ~/project
+    steps:
+      - checkout
+      - setup_google_dns
+      - run:
+          name: Install Semgrep
+          command: pip install semgrep
+      - run:
+          name: Run Semgrep (custom rules only)
+          command: semgrep scan --config .semgrep/rules . --error
+
   local_testing_part1:
     docker:
       - image: cimg/python:3.12
@@ -4114,6 +4132,12 @@ workflows:
               only:
                 - main
                 - /litellm_.*/
+      - semgrep:
+          filters:
+            branches:
+              only:
+                - main
+                - /litellm_.*/
       - local_testing_part1:
           filters:
             branches:
@@ -4492,6 +4516,7 @@ workflows:
       - publish_to_pypi:
           requires:
             - mypy_linting
+            - semgrep
             - local_testing_part1
             - local_testing_part2
             - build_and_test

.github/workflows/semgrep.yml

@@ -1,28 +0,0 @@
-# Semgrep: run only custom rules (.semgrep/rules) – no registry/auto rules.
-# Fast, no timeouts from heavy JS/Python registry rules on large files.
-name: Semgrep (custom rules only)
-
-on:
-  pull_request:
-    branches: [main]
-  push:
-    branches: [main]
-
-jobs:
-  semgrep:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: "3.12"
-
-      - name: Install Semgrep
-        run: pip install semgrep
-
-      - name: Run Semgrep (custom rules only)
-        run: semgrep scan --config .semgrep/rules . --error