ci: scheduled refresh of OpenAPI specs from semgrep.dev

[gaprl]

Stack context

Stacked on #2703 (auto-generated API reference for v1 + v2). That PR makes Mintlify render the API docs from the checked-in specs; this one keeps those specs fresh. Merge #2703 first.

What

New workflow update-openapi-specs.yml (weekday-morning cron + manual workflow_dispatch):

1. Fetches both specs from what semgrep-app serves in production:
   • docs/public_v1.openapi.yaml ← https://semgrep.dev/api/v1/public_v1.openapi.yaml
   • docs/public_v2.openapi.yaml ← https://semgrep.dev/api/v2/openapi.yaml
2. Mirrors x-displayName tag names into x-group (Mintlify's extension for nav group labels; skipped once upstream emits x-group natively).
3. Runs mintlify validate against the fetched specs — a bad or partial upstream spec blocks the update instead of breaking the live docs.
4. Opens a PR only when the specs changed (peter-evans/create-pull-request, chore/update-openapi-specs branch, auto-deleted after merge).

Actions are pinned to full commit SHAs with version comments.

Caveats

• PRs opened with the default GITHUB_TOKEN don't trigger Docs CI on the created PR. Reviewers can close/reopen to run CI, or provide a DOCS_BOT_TOKEN secret (the workflow prefers it automatically when present).
• The live specs currently contain validation bugs (type: bool, duplicate tags, prose in a type: field) that were patched in the checked-in copies in API reference: auto-generate from OpenAPI specs, add v1 and v2 #2703. Until they're fixed at the source in semgrep-app, the first scheduled run will fail at the validate step by design — that's the guard doing its job, not a workflow bug.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
semgrep-docs	🟢 Ready	View Preview	Jul 22, 2026, 6:59 PM

[semgrep-zcs-prod-semgrep]

Semgrep found 1 generic_bearer_auth_header finding:

• docs/public_v2.openapi.yaml
  • L17793 - Triage

Hardcoded sensitive data leaked

Semgrep has detected a leak of sensitive data in this code. This secret data could be used by internal or external malicious actors. We highly recommend you change, reset, or rotate the sensitive data.

A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.