# Repository guidance

- Semgrep CI is implemented in `.github/workflows/semgrep.yml` and invoked by `.github/workflows/deploy.yml`.
- The canonical Semgrep ignore policy is `.github/semgrepignore`; CI copies it to `.semgrepignore` at each scan root.
- Validate custom rules with `semgrep --validate --config .github/semgrep/rules/custom-rules.yml --metrics=off --no-rewrite-rule-ids`.
- Run custom-rule behavior tests with `python .github/scripts/tests/test_semgrep_rules.py`.
- Run consolidated security-report integration tests with `python .github/scripts/tests/test_html_reports.py`.