From c6745dbea373514102431a04d89ea34e33e8b824 Mon Sep 17 00:00:00 2001
From: Alexsander Hamir <alexsanderhamirgomesbaptista@gmail.com>
Date: Tue, 10 Feb 2026 17:02:59 -0800
Subject: [PATCH] Move Semgrep to CircleCI, add as release gate

---
 .circleci/config.yml          | 25 +++++++++++++++++++++++++
 .github/workflows/semgrep.yml | 28 ----------------------------
 2 files changed, 25 insertions(+), 28 deletions(-)
 delete mode 100644 .github/workflows/semgrep.yml

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 34c3f05cd25..17856e34b45 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -112,6 +112,24 @@ jobs:
             python -m mypy .
             cd ..
           no_output_timeout: 10m
+
+  semgrep:
+    docker:
+      - image: cimg/python:3.12
+        auth:
+          username: ${DOCKERHUB_USERNAME}
+          password: ${DOCKERHUB_PASSWORD}
+    working_directory: ~/project
+    steps:
+      - checkout
+      - setup_google_dns
+      - run:
+          name: Install Semgrep
+          command: pip install semgrep
+      - run:
+          name: Run Semgrep (custom rules only)
+          command: semgrep scan --config .semgrep/rules . --error
+
   local_testing_part1:
     docker:
       - image: cimg/python:3.12
@@ -4114,6 +4132,12 @@ workflows:
               only:
                 - main
                 - /litellm_.*/
+      - semgrep:
+          filters:
+            branches:
+              only:
+                - main
+                - /litellm_.*/
       - local_testing_part1:
           filters:
             branches:
@@ -4492,6 +4516,7 @@ workflows:
       - publish_to_pypi:
           requires:
             - mypy_linting
+            - semgrep
             - local_testing_part1
             - local_testing_part2
             - build_and_test
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
deleted file mode 100644
index a9ecdc5c261..00000000000
--- a/.github/workflows/semgrep.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Semgrep: run only custom rules (.semgrep/rules) – no registry/auto rules.
-# Fast, no timeouts from heavy JS/Python registry rules on large files.
-name: Semgrep (custom rules only)
-
-on:
-  pull_request:
-    branches: [main]
-  push:
-    branches: [main]
-
-jobs:
-  semgrep:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: "3.12"
-
-      - name: Install Semgrep
-        run: pip install semgrep
-
-      - name: Run Semgrep (custom rules only)
-        run: semgrep scan --config .semgrep/rules . --error