Add Semgrep configuration and ignore file; update CONTRIBUTING.md and README.md

[localpath]

GIV-9546: Add Semgrep SAST and README trust badges for the loader

What is the feature/bug?

The public payment-elements loader had CI, Inspector, CodeQL, and Socket, but no Semgrep SAST. The README also lacked an honest trust strip; the Socket badge story was pinned to the bootstrap latest package rather than the live package page.

What is the solution?

• .github/workflows/semgrep.yml: blocking p/secrets (repo-wide) and p/typescript + p/javascript (src/, test/) on PRs to main, plus weekly cron and workflow_dispatch; SARIF artifacts retained 90 days
• .semgrepignore: skip generated types/, build output, and node_modules/
• README.md: npm next, CI, Semgrep, Socket (package-level), license, and Node badges; docs link pointed at /payment-elements
• CONTRIBUTING.md: PR check expectations and a maintainers scanners table (Semgrep, Inspector, CodeQL, Socket, npm provenance)

What areas of the application does it impact?

Overflow-App/payment-elements only (CI/docs). No runtime loader or CDN SDK changes.

Testing

• Local Semgrep via semgrep/semgrep Docker image on src/ + test/: 0 findings
• GitHub Semgrep + CI: to run on this PR

Notes

• After first green Semgrep run, mark the Semgrep check required on main.
• Semgrep badge 404s until this workflow lands on the default branch.
• CI badge may stay red while Dependabot build(deps-dev): bump the dev-dependencies group across 1 directory with 4 updates #7 (TS 7 / Vitest 4 majors) is the latest failing CI run; actions Dependabot build(deps): bump the actions group across 1 directory with 4 updates #12 is green.

[amazon-inspector-oregon]

⏳ I'm reviewing this pull request for security vulnerabilities and code quality issues. I'll provide an update when I'm done

[amazon-inspector-oregon]

✅ I finished the code review, and didn't find any security or code quality issues.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds Semgrep SAST scanning to CI and updates repository documentation to reflect security/trust signals and contributor expectations.

Changes:

• Introduce a Semgrep GitHub Actions workflow with secrets + JS/TS rules and SARIF artifact upload.
• Add .semgrepignore to exclude generated/build/vendor paths from scans.
• Update README badges/docs link and expand CONTRIBUTING with PR check expectations + a scanners table.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
README.md	Adds trust/status badges and adjusts documentation link.
CONTRIBUTING.md	Documents expected PR checks and adds maintainers’ scanner matrix.
.semgrepignore	Defines Semgrep ignore paths for generated/build/vendor artifacts.
.github/workflows/semgrep.yml	Adds Semgrep CI workflow for PRs + scheduled scans with SARIF artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.