Added Semgrep_Rules/rules.yaml and update semgrep-cli-options

[yeswantr]

This PR adds a Semgrep_Rules directory at the root of the repository and updates the reusable Semgrep scan workflow to include custom Qualcomm security rules.

Changes Made:

• Added Semgrep_Rules/rules.yaml sourced from the internal qpsi repository
• Updated semgrep-cli-options in .github/workflows/reusable-semgrep-scan.yml to include: --config auto --config Semgrep_Rules/rules.yaml

References

• Source rules: https://github.qualcomm.com/qpsi/semgrep_vuln_discovery/blob/main/semgrep_checkers/rules.yaml

[Mark Matyas (mynameistechno)]

yeswantr can you join the qualcomm org please? see New Contributor Checklist at go/qcomgithub

[Copilot]

Pull request overview

This PR introduces a repository-local Semgrep ruleset and updates the reusable Semgrep scan workflow default options so runs include Qualcomm’s custom security rules by default.

Changes:

• Added Semgrep_Rules/rules.yaml containing a large set of custom Semgrep rules.
• Updated .github/workflows/reusable-semgrep-scan.yml default semgrep-cli-options to load both --config auto and the new local rules file.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
Semgrep_Rules/rules.yaml	Adds the custom Qualcomm Semgrep ruleset to be referenced by workflows.
.github/workflows/reusable-semgrep-scan.yml	Updates the reusable workflow’s default Semgrep CLI options to include the new rules file.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Mark Matyas (mynameistechno)]

yeswantr can you join the qualcomm org please? see New Contributor Checklist at go/qcomgithub

Please review our internal guidelines at go/qcomgithub and go/osdo. You're not using the correct open source identity in your commits and not signing off the commits either. Please correct the existing commits.

[Mark Matyas (mynameistechno)]

See my existing comments to fix commit authorship.

[Mark Matyas (mynameistechno)]

Also please see go/ossbestpracticesdoc for commit message best practices.

[Mark Matyas (mynameistechno)]

• Source rules: https://github.qualcomm.com/qpsi/semgrep_vuln_discovery/blob/main/semgrep_checkers/rules.yaml

Avoid posting internal-only full URLs externally on the public GitHub.