ci: add MicroHealth's shared Opengrep SAST workflow

.github/workflows/sast.yml

@@ -0,0 +1,20 @@
+name: SAST
+# MicroHealth's shared static analysis: Opengrep with MicroHealth's rules
+# (MicroHealthLLC/sast-rules). The pin below is moved by a pull request that
+# sast-rules opens on each release; merging it is how this repository takes
+# new rules.
+on:
+  schedule:
+    # Daily — 10:30 PM US Eastern (EDT) = 02:30 UTC the next day
+    - cron: "30 2 * * *"
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  sast:
+    permissions: {contents: read, actions: read, security-events: write, id-token: write}
+    uses: MicroHealthLLC/sast-rules/.github/workflows/opengrep.yml@d7c3dad1ed1fe24d092f469360ca68d00a3a654d # v2026.10.0
+    with:
+      aws_region: ${{ vars.AWS_REGION_EAST_1 }}
+      s3_bucket: ${{ vars.SECURITY_REPORTS_S3_BUCKET }}
+    secrets: inherit

SECURITY.md

@@ -110,6 +110,11 @@ a release waits for it to pass on the same commit. Security-relevant gates:
   audit (esp-idf-sbom, NVD) of ESP-IDF, its libraries and the components of both images that
   blocks on new high/critical findings.
 
+Outside the Tests workflow, `.github/workflows/sast.yml` runs MicroHealth's shared static
+analysis nightly (and on demand): Opengrep with MicroHealth's rules
+(`MicroHealthLLC/sast-rules`, pinned by commit). It is report-only; findings go to GitHub code
+scanning and to MicroHealth's security reports.
+
 Found while introducing these checks:
 
 | Finding | Status |