ci: hooks basic checks

[liukatkat]

What:

This PR adds basic CI to verify that the repository’s hooks work with any Semgrep version greater than or equal to the one specified in semgrep-version.

The PR also adds CI to ensure that the plugin version is updated each time we make a change to the files within the plugin/ directory.

• .github/workflows/test.yml is the main CI workflow file
• tests/ contains all the scripts for testing the commands we run in the hooks

Why:

We want to ensure that the plugin remains compatible with semgrep, since some of its hooks rely on specific semgrep features. I considered bundling Semgrep directly or adopting an approach similar to the old mcp repo/ the semgrep-rpc, but neither model fits this plugin well. The main reasons are:

1. Bundling the Semgrep binary with the plugin would effectively allow multiple Semgrep versions to coexist, which would make debugging far more difficult.
2. Unlike other repositories with a tightly coupled release process, the plugin’s version does not need to match Semgrep’s release cadence. It’s generally forward-compatible and won’t require updates for every Semgrep release.
3. The plugin’s main branch effectively serves as its “released” version, which is quite different from some of the other workflows we have.
4. We can't really add semgrep as a dependency like we have done in the mcp/ semgrep-rpc repo.

Given this, I chose to use CI for enforcing compatibility by verifying that everything in main works against the specific Semgrep version defined in the repo.

Test plan:

CI passing!

[liukatkat]

• ci: hooks basic checks #3 👈 (View in Graphite)
• feat: session start hook #2
• initial setup #1
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[nmote]

Do we need this even though we aren't doing a shallow checkout?

[liukatkat]

I think so, because I thought we need this to get the currently version on main. I am not extremely familiar with how this is typically done though, so I am not very sure.

(I might merge this first since it is a CI thing that I can probably fix later. I want to make sure we have both the Claude Plugin ready and the Cursor hooks ready by the end of this week for people to try out. But I am more than happy to update the checks!)