Merge commit 'be98c23a9fdbdd30caa9b607f2cf44a56b4cd0a3' into ci-refactor

.github/CODEOWNERS

@@ -0,0 +1,11 @@
+# These owners will be the default owners for everything in
+# the repo. Unless a later match takes precedence,
+# @temporalio/sdk will be requested for review when
+# someone opens a pull request.
+* @temporalio/sdk
+
+# Security team must approve exceptions to static analysis
+# scans, and any custom rules.
+
+.semgrepignore @temporalio/security
+.semgrep/ @temporalio/security

.github/workflows/semgrep.yml

@@ -0,0 +1,25 @@
+name: Semgrep
+on:
+  workflow_dispatch: {}
+  pull_request: {}
+  push:
+    branches:
+      - main
+      - master
+    paths:
+      - .github/workflows/semgrep.yml
+  schedule:
+    # random HH:MM to avoid a load spike on GitHub Actions at 00:00
+    - cron: '14 20 * * *'
+jobs:
+  semgrep:
+    name: semgrep/ci
+    runs-on: ubuntu-20.04
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+    container:
+      image: returntocorp/semgrep
+    if: (github.actor != 'dependabot[bot]')
+    steps:
+      - uses: actions/checkout@v3
+      - run: semgrep ci

.gitignore

@@ -9,4 +9,6 @@ packages/test/protos/root.d.ts
 packages/testing/test-server*
 packages/testing/generated-protos/
 packages/core-bridge/releases
-packages/*/package-lock.json
+packages/*/package-lock.json
+/sdk-node.iml
+*~

lerna.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.7.4",
+  "version": "1.8.4",
   "npmClient": "npm",
   "command": {
     "publish": {