fix(sast): set semgrep metrics off by flag and env, skip the version check

.forgejo/workflows/sast.yml

@@ -20,12 +20,13 @@ jobs:
       - name: semgrep
         env:
           CONFIGS: ${{ inputs.config }}
-          # The env var, not --metrics=off: semgrep 1.90 still prints its
-          # "reports pseudonymous rule metrics" notice for registry configs
-          # when given only the flag, and does not with the env var.
+          # Both the env var and --metrics=off. Inside a job semgrep 1.90
+          # still prints its registry "pseudonymous rule metrics" notice;
+          # that could not be reproduced outside a job, so it is unexplained.
           SEMGREP_SEND_METRICS: "off"
+          SEMGREP_ENABLE_VERSION_CHECK: "0"
         run: |
           semgrep --version
-          set -- scan --error --disable-version-check
+          set -- scan --error --metrics=off --disable-version-check
           for c in $CONFIGS; do set -- "$@" --config "$c"; done
           semgrep "$@"