fix(static-analysis): fix for semgrep check failures

static-analysis/action.yaml

@@ -11,18 +11,35 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@v4
+    - name: Checkout Repository
+      uses: actions/checkout@v4
       with:
-        fetch-depth: 2 # Fetch only the last two commits for efficient diff comparison
+        fetch-depth: 0 # Fetch all commits to ensure complete diff analysis
 
-    - run: |
+    - name: Determine Baseline Commit
+      id: baseline
+      run: |
+        set -e
+        echo "Calculating baseline commit..."
+        BASELINE_COMMIT=$(git merge-base HEAD origin/${GITHUB_BASE_REF})
+        if [ -z "$BASELINE_COMMIT" ]; then
+          echo "ERROR: Failed to determine baseline commit"
+          exit 1
+        fi
+        echo "Baseline Commit: $BASELINE_COMMIT"
+        echo "baseline_commit=$BASELINE_COMMIT" >> $GITHUB_OUTPUT
+      shell: bash
+
+    - name: Run Semgrep Scan
+      run: |
+        echo "Starting Semgrep scan..."
         docker run --rm -v "${PWD}:/src" \
         -e SEMGREP_APP_TOKEN=${{ inputs.semgrep-app-token }} \
         -e SEMGREP_REPO_NAME=${GITHUB_REPOSITORY} \
         -e SEMGREP_BRANCH=${GITHUB_REF} \
         -e SEMGREP_COMMIT=${{ github.event.pull_request.head.sha }} \
         -e SEMGREP_PR_ID=${{ github.event.pull_request.number }} \
-        -e SEMGREP_BASELINE_REF='HEAD^' \
+        -e SEMGREP_BASELINE_REF=${{ steps.baseline.outputs.baseline_commit }} \
         semgrep/semgrep:latest-nonroot \
         semgrep ci
       shell: bash