Update GitHub Action returntocorp/semgrep to v1.170.0

[hash-worker]

This PR contains the following updates:

Package	Type	Update	Change	Pending
returntocorp/semgrep	container	minor	1.151.0 → 1.170.0	1.172.0 (+2)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 2am on saturday"
• Automerge
  • "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 1, 2026 1:13am
hashdotdesign-tokens	Ready	Preview	Aug 1, 2026 1:13am
petrinaut	Ready	Preview	Aug 1, 2026 1:13am

[cursor]

PR Summary

Low Risk
Single CI dependency version bump with no application or auth changes; only affects how static analysis runs in GitHub Actions.

Overview
Bumps the Semgrep CI job container image from 1.151.0 to 1.170.0, including an updated image digest pin in .github/workflows/semgrep.yml.

Scan behavior is unchanged: the workflow still runs semgrep ci with SARIF upload to GitHub Advanced Security on PRs, pushes, and the existing schedule.

^{Reviewed by Cursor Bugbot for commit 1cd6117. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.58%. Comparing base (fb8a6d1) to head (1cd6117).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9134      +/-   ##
==========================================
- Coverage   59.58%   59.58%   -0.01%     
==========================================
  Files        1410     1410              
  Lines      137977   137980       +3     
  Branches     6494     6494              
==========================================
- Hits        82212    82210       -2     
- Misses      54729    54734       +5     
  Partials     1036     1036              

Flag	Coverage Δ
apps.hash-ai-worker-ts	1.99% <ø> (ø)
apps.hash-api	12.57% <ø> (ø)
blockprotocol.type-system	40.84% <ø> (ø)
local.claude-hooks	0.00% <ø> (ø)
local.harpc-client	51.49% <ø> (ø)
local.hash-backend-utils	2.55% <ø> (ø)
local.hash-graph-sdk	10.02% <ø> (ø)
local.hash-isomorphic-utils	12.25% <ø> (ø)
rust.antsi	0.00% <ø> (ø)
rust.error-stack	90.89% <ø> (ø)
rust.harpc-codec	84.70% <ø> (ø)
rust.harpc-net	96.19% <ø> (-0.04%)	⬇️
rust.harpc-tower	67.03% <ø> (ø)
rust.harpc-types	0.00% <ø> (ø)
rust.harpc-wire-protocol	92.23% <ø> (ø)
rust.hash-codec	72.76% <ø> (ø)
rust.hash-graph-api	7.37% <ø> (-0.01%)	⬇️
rust.hash-graph-authorization	62.59% <ø> (ø)
rust.hash-graph-embeddings	91.88% <ø> (ø)
rust.hash-graph-postgres-store	29.66% <ø> (ø)
rust.hash-graph-store	42.16% <ø> (ø)
rust.hash-graph-temporal-versioning	47.95% <ø> (ø)
rust.hash-graph-types	0.00% <ø> (ø)
rust.hash-graph-validation	84.71% <ø> (ø)
rust.hashql-ast	89.63% <ø> (ø)
rust.hashql-compiletest	28.39% <ø> (ø)
rust.hashql-core	78.98% <ø> (ø)
rust.hashql-diagnostics	72.51% <ø> (ø)
rust.hashql-eval	79.82% <ø> (ø)
rust.hashql-hir	89.09% <ø> (ø)
rust.hashql-mir	87.92% <ø> (ø)
rust.hashql-syntax-jexpr	94.04% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed-hq]

Merging this PR will not alter performance

✅ 98 untouched benchmarks

---

_{Comparing deps/gha/returntocorp-semgrep-1.x (1cd6117) with main (fb8a6d1)¹}

Footnotes

1. No successful run was found on main (6afcaff) during the generation of this report, so fb8a6d1 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[github-actions]

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$28.2 \mathrm{ms} \pm 198 \mathrm{μs}\left({\color{gray}-0.156 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.50 \mathrm{ms} \pm 26.6 \mathrm{μs}\left({\color{gray}-0.467 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$13.6 \mathrm{ms} \pm 117 \mathrm{μs}\left({\color{gray}1.40 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$47.3 \mathrm{ms} \pm 489 \mathrm{μs}\left({\color{red}5.24 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$15.5 \mathrm{ms} \pm 149 \mathrm{μs}\left({\color{gray}2.42 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$25.6 \mathrm{ms} \pm 206 \mathrm{μs}\left({\color{gray}0.089 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$29.4 \mathrm{ms} \pm 200 \mathrm{μs}\left({\color{gray}0.808 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.85 \mathrm{ms} \pm 27.8 \mathrm{μs}\left({\color{gray}-0.011 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$14.7 \mathrm{ms} \pm 106 \mathrm{μs}\left({\color{gray}1.53 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.90 \mathrm{ms} \pm 28.0 \mathrm{μs}\left({\color{gray}-0.047 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.07 \mathrm{ms} \pm 23.0 \mathrm{μs}\left({\color{gray}-0.496 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.47 \mathrm{ms} \pm 23.3 \mathrm{μs}\left({\color{gray}-0.537 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.34 \mathrm{ms} \pm 35.9 \mathrm{μs}\left({\color{gray}-0.347 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.62 \mathrm{ms} \pm 26.9 \mathrm{μs}\left({\color{gray}-1.608 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.26 \mathrm{ms} \pm 27.4 \mathrm{μs}\left({\color{gray}-1.249 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.52 \mathrm{ms} \pm 30.7 \mathrm{μs}\left({\color{gray}-0.371 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.52 \mathrm{ms} \pm 23.8 \mathrm{μs}\left({\color{gray}-0.898 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.17 \mathrm{ms} \pm 28.4 \mathrm{μs}\left({\color{gray}-1.669 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.64 \mathrm{ms} \pm 16.3 \mathrm{μs}\left({\color{gray}-4.013 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.56 \mathrm{ms} \pm 17.7 \mathrm{μs}\left({\color{gray}-1.495 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.62 \mathrm{ms} \pm 14.1 \mathrm{μs}\left({\color{gray}-4.573 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.90 \mathrm{ms} \pm 16.0 \mathrm{μs}\left({\color{gray}-3.940 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.69 \mathrm{ms} \pm 17.2 \mathrm{μs}\left({\color{gray}-3.297 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.90 \mathrm{ms} \pm 18.8 \mathrm{μs}\left({\color{gray}-3.477 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.10 \mathrm{ms} \pm 20.3 \mathrm{μs}\left({\color{gray}-0.937 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.81 \mathrm{ms} \pm 19.8 \mathrm{μs}\left({\color{gray}-1.019 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$3.00 \mathrm{ms} \pm 18.3 \mathrm{μs}\left({\color{gray}-2.932 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.52 \mathrm{ms} \pm 29.0 \mathrm{μs}\left({\color{gray}-1.625 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.04 \mathrm{ms} \pm 25.5 \mathrm{μs}\left({\color{gray}-1.508 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.35 \mathrm{ms} \pm 20.5 \mathrm{μs}\left({\color{gray}-1.487 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.47 \mathrm{ms} \pm 25.1 \mathrm{μs}\left({\color{gray}0.643 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.01 \mathrm{ms} \pm 17.3 \mathrm{μs}\left({\color{gray}-2.268 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.35 \mathrm{ms} \pm 16.7 \mathrm{μs}\left({\color{gray}-1.815 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$44.1 \mathrm{ms} \pm 356 \mathrm{μs}\left({\color{gray}-0.023 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$34.8 \mathrm{ms} \pm 247 \mathrm{μs}\left({\color{gray}0.555 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$37.3 \mathrm{ms} \pm 310 \mathrm{μs}\left({\color{gray}-0.087 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$33.1 \mathrm{ms} \pm 231 \mathrm{μs}\left({\color{gray}-1.034 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$43.8 \mathrm{ms} \pm 271 \mathrm{μs}\left({\color{gray}-0.774 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$51.5 \mathrm{ms} \pm 288 \mathrm{μs}\left({\color{gray}-1.424 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$42.3 \mathrm{ms} \pm 268 \mathrm{μs}\left({\color{gray}-0.074 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$95.8 \mathrm{ms} \pm 650 \mathrm{μs}\left({\color{gray}2.16 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$45.8 \mathrm{ms} \pm 3.64 \mathrm{ms}\left({\color{red}28.9 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$285 \mathrm{ms} \pm 834 \mathrm{μs}\left({\color{lightgreen}-8.903 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$11.4 \mathrm{ms} \pm 78.1 \mathrm{μs}\left({\color{gray}-0.892 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$11.6 \mathrm{ms} \pm 89.6 \mathrm{μs}\left({\color{gray}-1.201 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$11.6 \mathrm{ms} \pm 89.8 \mathrm{μs}\left({\color{gray}-1.010 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$11.5 \mathrm{ms} \pm 86.4 \mathrm{μs}\left({\color{gray}0.137 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$11.5 \mathrm{ms} \pm 73.0 \mathrm{μs}\left({\color{gray}-1.359 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$11.5 \mathrm{ms} \pm 77.7 \mathrm{μs}\left({\color{gray}-0.830 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$11.6 \mathrm{ms} \pm 81.2 \mathrm{μs}\left({\color{gray}0.002 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$11.6 \mathrm{ms} \pm 71.1 \mathrm{μs}\left({\color{gray}-0.651 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$11.7 \mathrm{ms} \pm 86.5 \mathrm{μs}\left({\color{gray}-0.459 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$12.0 \mathrm{ms} \pm 88.0 \mathrm{μs}\left({\color{gray}-0.020 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1	$$12.0 \mathrm{ms} \pm 77.5 \mathrm{μs}\left({\color{gray}1.78 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1	$$12.0 \mathrm{ms} \pm 90.7 \mathrm{μs}\left({\color{gray}0.297 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1	$$12.1 \mathrm{ms} \pm 86.4 \mathrm{μs}\left({\color{gray}0.108 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1	$$12.1 \mathrm{ms} \pm 85.9 \mathrm{μs}\left({\color{gray}-0.415 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2	$$12.0 \mathrm{ms} \pm 70.0 \mathrm{μs}\left({\color{gray}0.265 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1	$$12.0 \mathrm{ms} \pm 84.6 \mathrm{μs}\left({\color{gray}-0.161 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1	$$12.0 \mathrm{ms} \pm 74.5 \mathrm{μs}\left({\color{gray}-0.545 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1	$$12.0 \mathrm{ms} \pm 88.8 \mathrm{μs}\left({\color{gray}1.17 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1	$$12.0 \mathrm{ms} \pm 102 \mathrm{μs}\left({\color{gray}1.32 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba	$$8.81 \mathrm{ms} \pm 56.8 \mathrm{μs}\left({\color{gray}-0.217 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$62.6 \mathrm{ms} \pm 375 \mathrm{μs}\left({\color{gray}1.43 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$114 \mathrm{ms} \pm 563 \mathrm{μs}\left({\color{gray}-1.090 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$69.7 \mathrm{ms} \pm 514 \mathrm{μs}\left({\color{gray}-0.687 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$79.4 \mathrm{ms} \pm 552 \mathrm{μs}\left({\color{gray}0.237 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$89.2 \mathrm{ms} \pm 670 \mathrm{μs}\left({\color{gray}1.35 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$93.9 \mathrm{ms} \pm 703 \mathrm{μs}\left({\color{gray}-0.929 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$46.2 \mathrm{ms} \pm 271 \mathrm{μs}\left({\color{gray}1.10 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$74.8 \mathrm{ms} \pm 508 \mathrm{μs}\left({\color{gray}-0.438 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$52.1 \mathrm{ms} \pm 329 \mathrm{μs}\left({\color{gray}-0.377 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$62.3 \mathrm{ms} \pm 418 \mathrm{μs}\left({\color{gray}-0.376 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$64.4 \mathrm{ms} \pm 498 \mathrm{μs}\left({\color{gray}0.366 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$63.9 \mathrm{ms} \pm 453 \mathrm{μs}\left({\color{gray}-0.263 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$126 \mathrm{ms} \pm 785 \mathrm{μs}\left({\color{gray}1.22 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$135 \mathrm{ms} \pm 722 \mathrm{μs}\left({\color{gray}0.583 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$25.2 \mathrm{ms} \pm 154 \mathrm{μs}\left({\color{red}29.9 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$554 \mathrm{ms} \pm 1.46 \mathrm{ms}\left({\color{red}6.04 \mathrm{\%}}\right) $$	Flame Graph