Provide more release tags for CI consumption stability about semgrep-action

[underyx]

Yeah, we'll need to address this very soon! Thanks for creating an issue for the discussion. We're still shipping backwards incompatible API changes to Semgrep Community sometimes and might need to hold out for a bit longer without worrying about deprecation policies, personally I'd guess a month or so.

In the meantime you can probably specify pin the image yourself by getting the latest SHA here: https://hub.docker.com/layers/returntocorp/semgrep-agent/v1/images/sha256-fd994be1b39501685a433835a3a54a975412bb9f77707b4e359332c4458b640b?context=explore

So according to this page right now you could use this image:

returntocorp/semgrep-agent:v1@sha256:fd994be1b39501685a433835a3a54a975412bb9f77707b4e359332c4458b640b

and it would always use the same exact code. We don't advertise this option and wouldn't recommend this though cause failing due to API changes is likelier now, than due to a new semgrep-agent release.

[msorens]

Thanks for the details, @underyx . Based on your advice, then, I will hold off using that for now.

[brendongo]

Moving forward, functionality here will be in lockstep with semgrep releases so we can include an additional tag for stability