[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVJA5QPF5NK7AM2K3WPRBK":3,"skill-same:01M6EVJA5QPF5NK7AM2K3WPRBK":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":14,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6EVJA5QPF5NK7AM2K3WPRBK","integrating-sast-into-github-actions-pipeline",null,"This skill covers integrating Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI\u002FCD pipelines. It addresses configuring automated code scanning on pull requests and pushes, tuning rules to reduce false positives, uploading SARIF results to GitHub Advanced Security, and establishing quality gates that block merges when high-severity vulnerabilities are detected.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fintegrating-sast-into-github-actions-pipeline\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"github","sast","actions","integrating sast into github actions pipeline","github actions","pipeline","advanced","testing","CI\u002FCD","false","scanning","semgrep","tuning","t1195","codeql","ci","code","secure","pull requests","cybersecurity","2026-11-10 10:12:30",false,"---\nname: integrating-sast-into-github-actions-pipeline\ndescription: 'This skill covers integrating Static Application Security Testing (SAST)\n  tools—CodeQL and Semgrep—into GitHub Actions CI\u002FCD pipelines. It addresses configuring\n  automated code scanning on pull requests and pushes, tuning rules to reduce false\n  positives, uploading SARIF results to GitHub Advanced Security, and establishing\n  quality gates that block merges when high-severity vulnerabilities are detected.\n\n  '\ndomain: cybersecurity\nsubdomain: devsecops\ntags:\n- devsecops\n- cicd\n- sast\n- codeql\n- semgrep\n- secure-sdlc\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- GV.SC-07\n- ID.IM-04\n- PR.PS-04\nmitre_attack:\n- T1195\n- T1554\n- T1059.004\n---\n\n# Integrating SAST into GitHub Actions Pipeline\n\n## When to Use\n\n- When development teams need automated code-level vulnerability detection on every pull request\n- When security teams require consistent SAST enforcement across all repositories in an organization\n- When migrating from manual or periodic security reviews to continuous security testing\n- When compliance frameworks (SOC 2, PCI DSS, NIST SSDF) require evidence of automated code analysis\n- When multiple languages coexist in a monorepo and need unified scanning under one workflow\n\n**Do not use** for runtime vulnerability detection (use DAST instead), for scanning third-party dependencies (use SCA tools like Snyk), or for infrastructure-as-code scanning (use Checkov or tfsec).\n\n## Prerequisites\n\n- GitHub repository with GitHub Actions enabled\n- GitHub Advanced Security license (required for CodeQL on private repos; free for public repos)\n- Semgrep account for managed rules and Semgrep App dashboard (free tier available)\n- Repository code in a supported language: Python, JavaScript\u002FTypeScript, Java, C\u002FC++, C#, Go, Ruby, Swift, Kotlin\n\n## Workflow\n\n### Step 1: Configure CodeQL Analysis Workflow\n\nCreate a CodeQL workflow that runs on pull requests and on a weekly schedule to catch vulnerabilities in existing code.\n\n```yaml\n# .github\u002Fworkflows\u002Fcodeql-analysis.yml\nname: \"CodeQL Analysis\"\n\non:\n  push:\n    branches: [main, develop]\n  pull_request:\n    branches: [main]\n  schedule:\n    - cron: '30 2 * * 1'  # Weekly Monday 2:30 AM\n\njobs:\n  analyze:\n    name: Analyze (${{ matrix.language }})\n    runs-on: ubuntu-latest\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n\n    strategy:\n      fail-fast: false\n      matrix:\n        language: ['javascript', 'python']\n\n    steps:\n      - name: Checkout repository\n        uses: actions\u002Fcheckout@v4\n\n      - name: Initialize CodeQL\n        uses: github\u002Fcodeql-action\u002Finit@v3\n        with:\n          languages: ${{ matrix.language }}\n          queries: security-extended,security-and-quality\n\n      - name: Autobuild\n        uses: github\u002Fcodeql-action\u002Fautobuild@v3\n\n      - name: Perform CodeQL Analysis\n        uses: github\u002Fcodeql-action\u002Fanalyze@v3\n        with:\n          category: \"\u002Flanguage:${{ matrix.language }}\"\n```\n\n### Step 2: Add Semgrep Scanning for Custom Rules\n\nSemgrep complements CodeQL with faster scans and support for custom pattern-based rules. Configure it to upload SARIF results to the same GitHub Security tab.\n\n```yaml\n# .github\u002Fworkflows\u002Fsemgrep.yml\nname: \"Semgrep SAST Scan\"\n\non:\n  pull_request:\n    branches: [main, develop]\n  push:\n    branches: [main]\n\njobs:\n  semgrep:\n    name: Semgrep Scan\n    runs-on: ubuntu-latest\n    permissions:\n      security-events: write\n      contents: read\n\n    container:\n      image: semgrep\u002Fsemgrep:latest\n\n    steps:\n      - name: Checkout\n        uses: actions\u002Fcheckout@v4\n\n      - name: Run Semgrep\n        run: |\n          semgrep ci \\\n            --config auto \\\n            --config p\u002Fowasp-top-ten \\\n            --config p\u002Fcwe-top-25 \\\n            --sarif --output semgrep-results.sarif \\\n            --severity ERROR \\\n            --error\n        env:\n          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}\n\n      - name: Upload SARIF\n        if: always()\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        with:\n          sarif_file: semgrep-results.sarif\n          category: semgrep\n```\n\n### Step 3: Create Custom Semgrep Rules for Organization Patterns\n\nWrite organization-specific rules to catch patterns unique to your codebase, such as deprecated internal APIs or insecure configuration patterns.\n\n```yaml\n# .semgrep\u002Fcustom-rules.yml\nrules:\n  - id: hardcoded-database-url\n    patterns:\n      - pattern: |\n          $DB_URL = \"...$PROTO:\u002F\u002F...:...$PASS@...\"\n    message: |\n      Hardcoded database connection string with credentials detected.\n      Use environment variables or a secrets manager instead.\n    languages: [python, javascript, typescript]\n    severity: ERROR\n    metadata:\n      cwe: \"CWE-798: Use of Hard-coded Credentials\"\n      owasp: \"A07:2021 - Identification and Authentication Failures\"\n\n  - id: unsafe-deserialization\n    patterns:\n      - pattern-either:\n          - pattern: pickle.loads(...)\n          - pattern: yaml.load(..., Loader=yaml.Loader)\n          - pattern: yaml.load(..., Loader=yaml.FullLoader)\n    message: |\n      Unsafe deserialization detected. Use safe alternatives to prevent\n      remote code execution vulnerabilities.\n    languages: [python]\n    severity: ERROR\n    metadata:\n      cwe: \"CWE-502: Deserialization of Untrusted Data\"\n\n  - id: missing-csrf-protection\n    patterns:\n      - pattern: |\n          @app.route(\"...\", methods=[\"POST\"])\n          def $FUNC(...):\n              ...\n      - pattern-not-inside: |\n          @csrf.exempt\n          ...\n    message: \"POST endpoint may lack CSRF protection.\"\n    languages: [python]\n    severity: WARNING\n```\n\n### Step 4: Establish Quality Gates with Branch Protection\n\nConfigure branch protection rules that require SAST checks to pass before merging, preventing vulnerable code from reaching production branches.\n\n```bash\n# Use GitHub CLI to set branch protection requiring SAST checks\ngh api repos\u002F{owner}\u002F{repo}\u002Fbranches\u002Fmain\u002Fprotection \\\n  --method PUT \\\n  --field required_status_checks='{\"strict\":true,\"contexts\":[\"Analyze (javascript)\",\"Analyze (python)\",\"Semgrep Scan\"]}' \\\n  --field enforce_admins=true \\\n  --field required_pull_request_reviews='{\"required_approving_review_count\":1}'\n```\n\n### Step 5: Tune and Suppress False Positives\n\nManage false positives through CodeQL query filters and Semgrep nosemgrep annotations to maintain developer trust in scan results.\n\n```yaml\n# codeql-config.yml - Custom CodeQL configuration\nname: \"Custom CodeQL Config\"\nqueries:\n  - uses: security-extended\n  - uses: security-and-quality\n  - excludes:\n      id: js\u002Funused-local-variable\npaths-ignore:\n  - '**\u002Ftest\u002F**'\n  - '**\u002Ftests\u002F**'\n  - '**\u002Fvendor\u002F**'\n  - '**\u002Fnode_modules\u002F**'\n  - '**\u002F*.test.js'\n  - '**\u002F*.spec.py'\n```\n\n```python\n# Example: Suppressing a known false positive in Semgrep\nimport subprocess\n\ndef run_safe_command(cmd_list):\n    # nosemgrep: python.lang.security.audit.dangerous-subprocess-use\n    result = subprocess.run(cmd_list, capture_output=True, text=True, shell=False)\n    return result.stdout\n```\n\n### Step 6: Aggregate and Report Findings\n\nUse the GitHub Security Overview dashboard and configure notifications for security alerts across repositories.\n\n```bash\n# Query SARIF results via GitHub API for reporting\ngh api repos\u002F{owner}\u002F{repo}\u002Fcode-scanning\u002Falerts \\\n  --jq '.[] | select(.state==\"open\") | {rule: .rule.id, severity: .rule.security_severity_level, file: .most_recent_instance.location.path, line: .most_recent_instance.location.start_line}'\n\n# Count open alerts by severity\ngh api repos\u002F{owner}\u002F{repo}\u002Fcode-scanning\u002Falerts \\\n  --jq '[.[] | select(.state==\"open\")] | group_by(.rule.security_severity_level) | map({severity: .[0].rule.security_severity_level, count: length})'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| SAST | Static Application Security Testing — analyzes source code without executing it to find security vulnerabilities |\n| SARIF | Static Analysis Results Interchange Format — standardized JSON format for expressing results from static analysis tools |\n| CodeQL | GitHub's semantic code analysis engine that treats code as data and queries it for vulnerability patterns |\n| Semgrep | Lightweight static analysis tool using pattern matching to find bugs and security issues across many languages |\n| Security Extended | CodeQL query suite that includes additional security queries beyond the default set for deeper analysis |\n| Quality Gate | Automated checkpoint that blocks code from progressing through the pipeline unless security criteria are met |\n| False Positive | A scan finding that incorrectly identifies secure code as vulnerable, requiring suppression or tuning |\n\n## Tools & Systems\n\n- **CodeQL**: GitHub's semantic code analysis engine with deep dataflow and taint tracking analysis\n- **Semgrep**: Fast, lightweight pattern-matching SAST tool with 3000+ community rules and custom rule support\n- **GitHub Advanced Security**: Platform providing code scanning, secret scanning, and dependency review in GitHub\n- **SARIF Viewer**: VS Code extension for reviewing SARIF results locally during development\n- **GitHub Security Overview**: Organization-level dashboard aggregating security alerts across all repositories\n\n## Common Scenarios\n\n### Scenario: Monorepo with Multiple Languages Needs Unified SAST\n\n**Context**: A platform team manages a monorepo containing Python microservices, TypeScript frontends, and Go infrastructure tools. Security reviews happen manually every quarter, missing vulnerabilities between reviews.\n\n**Approach**:\n1. Configure CodeQL with a matrix strategy covering Python, JavaScript, and Go languages\n2. Add Semgrep with `--config auto` to detect language automatically and apply relevant rulesets\n3. Create path-based triggers so only changed language directories trigger their respective scans\n4. Upload all SARIF results to GitHub Security tab with unique categories per tool and language\n5. Set branch protection requiring all SAST jobs to pass before merge\n6. Schedule weekly full-repository scans to catch issues in unchanged code from newly published CVE patterns\n\n**Pitfalls**: Setting CodeQL to analyze all languages on every PR increases CI time significantly. Use path filters to trigger only relevant language scans. Semgrep's `--config auto` may enable rules that conflict with CodeQL findings, creating duplicate alerts.\n\n### Scenario: Reducing Alert Fatigue from High False Positive Rate\n\n**Context**: After enabling SAST, developers ignore findings because 40% are false positives, undermining the security program.\n\n**Approach**:\n1. Export all current alerts and categorize them as true positive, false positive, or informational\n2. Create a custom CodeQL config excluding noisy query IDs that produce the most false positives\n3. Write `.semgrepignore` patterns for test files, generated code, and vendored dependencies\n4. Establish a weekly triage meeting where security and development leads review new rule additions\n5. Track false positive rate as a metric and target below 15% for developer trust\n\n**Pitfalls**: Over-suppressing rules to reduce noise can create blind spots. Always validate suppressions against the OWASP Top 10 and CWE Top 25 to ensure critical vulnerability classes remain covered.\n\n## Output Format\n\n```\nSAST Pipeline Scan Report\n==========================\nRepository: org\u002Fweb-application\nBranch: feature\u002Fuser-auth-refactor\nScan Date: 2026-02-23\nCommit: a1b2c3d4\n\nCodeQL Results:\n  Language    Queries Run   Findings   Critical   High   Medium\n  javascript  312           4          1          2      1\n  python      287           2          0          1      1\n\nSemgrep Results:\n  Ruleset          Rules Matched   Findings   Errors   Warnings\n  auto             1,847           3          1        2\n  owasp-top-ten    186             2          1        1\n  custom-rules     12              1          0        1\n\nQUALITY GATE: FAILED\n  Blocking findings: 2 Critical\u002FHigh severity issues\n  - [CRITICAL] CWE-89: SQL Injection in src\u002Fapi\u002Fusers.py:47\n  - [HIGH] CWE-79: Cross-site Scripting in src\u002Fcomponents\u002FSearch.tsx:123\n\nAction Required: Fix blocking findings before merge is permitted.\n```\n","# Integrating SAST into GitHub Actions Pipeline\n\n## When to Use\n\n- When development teams need automated code-level vulnerability detection on every pull request\n- When security teams require consistent SAST enforcement across all repositories in an organization\n- When migrating from manual or periodic security reviews to continuous security testing\n- When compliance frameworks (SOC 2, PCI DSS, NIST SSDF) require evidence of automated code analysis\n- When multiple languages coexist in a monorepo and need unified scanning under one workflow\n\n**Do not use** for runtime vulnerability detection (use DAST instead), for scanning third-party dependencies (use SCA tools like Snyk), or for infrastructure-as-code scanning (use Checkov or tfsec).\n\n## Prerequisites\n\n- GitHub repository with GitHub Actions enabled\n- GitHub Advanced Security license (required for CodeQL on private repos; free for public repos)\n- Semgrep account for managed rules and Semgrep App dashboard (free tier available)\n- Repository code in a supported language: Python, JavaScript\u002FTypeScript, Java, C\u002FC++, C#, Go, Ruby, Swift, Kotlin\n\n## Workflow\n\n### Step 1: Configure CodeQL Analysis Workflow\n\nCreate a CodeQL workflow that runs on pull requests and on a weekly schedule to catch vulnerabilities in existing code.\n\n```yaml\n# .github\u002Fworkflows\u002Fcodeql-analysis.yml\nname: \"CodeQL Analysis\"\n\non:\n  push:\n    branches: [main, develop]\n  pull_request:\n    branches: [main]\n  schedule:\n    - cron: '30 2 * * 1'  # Weekly Monday 2:30 AM\n\njobs:\n  analyze:\n    name: Analyze (${{ matrix.language }})\n    runs-on: ubuntu-latest\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n\n    strategy:\n      fail-fast: false\n      matrix:\n        language: ['javascript', 'python']\n\n    steps:\n      - name: Checkout repository\n        uses: actions\u002Fcheckout@v4\n\n      - name: Initialize CodeQL\n        uses: github\u002Fcodeql-action\u002Finit@v3\n        with:\n          languages: ${{ matrix.language }}\n          queries: security-extended,security-and-quality\n\n      - name: Autobuild\n        uses: github\u002Fcodeql-action\u002Fautobuild@v3\n\n      - name: Perform CodeQL Analysis\n        uses: github\u002Fcodeql-action\u002Fanalyze@v3\n        with:\n          category: \"\u002Flanguage:${{ matrix.language }}\"\n```\n\n### Step 2: Add Semgrep Scanning for Custom Rules\n\nSemgrep complements CodeQL with faster scans and support for custom pattern-based rules. Configure it to upload SARIF results to the same GitHub Security tab.\n\n```yaml\n# .github\u002Fworkflows\u002Fsemgrep.yml\nname: \"Semgrep SAST Scan\"\n\non:\n  pull_request:\n    branches: [main, develop]\n  push:\n    branches: [main]\n\njobs:\n  semgrep:\n    name: Semgrep Scan\n    runs-on: ubuntu-latest\n    permissions:\n      security-events: write\n      contents: read\n\n    container:\n      image: semgrep\u002Fsemgrep:latest\n\n    steps:\n      - name: Checkout\n        uses: actions\u002Fcheckout@v4\n\n      - name: Run Semgrep\n        run: |\n          semgrep ci \\\n            --config auto \\\n            --config p\u002Fowasp-top-ten \\\n            --config p\u002Fcwe-top-25 \\\n            --sarif --output semgrep-results.sarif \\\n            --severity ERROR \\\n            --error\n        env:\n          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}\n\n      - name: Upload SARIF\n        if: always()\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        with:\n          sarif_file: semgrep-results.sarif\n          category: semgrep\n```\n\n### Step 3: Create Custom Semgrep Rules for Organization Patterns\n\nWrite organization-specific rules to catch patterns unique to your codebase, such as deprecated internal APIs or insecure configuration patterns.\n\n```yaml\n# .semgrep\u002Fcustom-rules.yml\nrules:\n  - id: hardcoded-database-url\n    patterns:\n      - pattern: |\n          $DB_URL = \"...$PROTO:\u002F\u002F...:...$PASS@...\"\n    message: |\n      Hardcoded database connection string with credentials detected.\n      Use environment variables or a secrets manager instead.\n    languages: [python, javascript, typescript]\n    severity: ERROR\n    metadata:\n      cwe: \"CWE-798: Use of Hard-coded Credentials\"\n      owasp: \"A07:2021 - Identification and Authentication Failures\"\n\n  - id: unsafe-deserialization\n    patterns:\n      - pattern-either:\n          - pattern: pickle.loads(...)\n          - pattern: yaml.load(..., Loader=yaml.Loader)\n          - pattern: yaml.load(..., Loader=yaml.FullLoader)\n    message: |\n      Unsafe deserialization detected. Use safe alternatives to prevent\n      remote code execution vulnerabilities.\n    languages: [python]\n    severity: ERROR\n    metadata:\n      cwe: \"CWE-502: Deserialization of Untrusted Data\"\n\n  - id: missing-csrf-protection\n    patterns:\n      - pattern: |\n          @app.route(\"...\", methods=[\"POST\"])\n          def $FUNC(...):\n              ...\n      - pattern-not-inside: |\n          @csrf.exempt\n          ...\n    message: \"POST endpoint may lack CSRF protection.\"\n    languages: [python]\n    severity: WARNING\n```\n\n### Step 4: Establish Quality Gates with Branch Protection\n\nConfigure branch protection rules that require SAST checks to pass before merging, preventing vulnerable code from reaching production branches.\n\n```bash\n# Use GitHub CLI to set branch protection requiring SAST checks\ngh api repos\u002F{owner}\u002F{repo}\u002Fbranches\u002Fmain\u002Fprotection \\\n  --method PUT \\\n  --field required_status_checks='{\"strict\":true,\"contexts\":[\"Analyze (javascript)\",\"Analyze (python)\",\"Semgrep Scan\"]}' \\\n  --field enforce_admins=true \\\n  --field required_pull_request_reviews='{\"required_approving_review_count\":1}'\n```\n\n### Step 5: Tune and Suppress False Positives\n\nManage false positives through CodeQL query filters and Semgrep nosemgrep annotations to maintain developer trust in scan results.\n\n```yaml\n# codeql-config.yml - Custom CodeQL configuration\nname: \"Custom CodeQL Config\"\nqueries:\n  - uses: security-extended\n  - uses: security-and-quality\n  - excludes:\n      id: js\u002Funused-local-variable\npaths-ignore:\n  - '**\u002Ftest\u002F**'\n  - '**\u002Ftests\u002F**'\n  - '**\u002Fvendor\u002F**'\n  - '**\u002Fnode_modules\u002F**'\n  - '**\u002F*.test.js'\n  - '**\u002F*.spec.py'\n```\n\n```python\n# Example: Suppressing a known false positive in Semgrep\nimport subprocess\n\ndef run_safe_command(cmd_list):\n    # nosemgrep: python.lang.security.audit.dangerous-subprocess-use\n    result = subprocess.run(cmd_list, capture_output=True, text=True, shell=False)\n    return result.stdout\n```\n\n### Step 6: Aggregate and Report Findings\n\nUse the GitHub Security Overview dashboard and configure notifications for security alerts across repositories.\n\n```bash\n# Query SARIF results via GitHub API for reporting\ngh api repos\u002F{owner}\u002F{repo}\u002Fcode-scanning\u002Falerts \\\n  --jq '.[] | select(.state==\"open\") | {rule: .rule.id, severity: .rule.security_severity_level, file: .most_recent_instance.location.path, line: .most_recent_instance.location.start_line}'\n\n# Count open alerts by severity\ngh api repos\u002F{owner}\u002F{repo}\u002Fcode-scanning\u002Falerts \\\n  --jq '[.[] | select(.state==\"open\")] | group_by(.rule.security_severity_level) | map({severity: .[0].rule.security_severity_level, count: length})'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| SAST | Static Application Security Testing — analyzes source code without executing it to find security vulnerabilities |\n| SARIF | Static Analysis Results Interchange Format — standardized JSON format for expressing results from static analysis tools |\n| CodeQL | GitHub's semantic code analysis engine that treats code as data and queries it for vulnerability patterns |\n| Semgrep | Lightweight static analysis tool using pattern matching to find bugs and security issues across many languages |\n| Security Extended | CodeQL query suite that includes additional security queries beyond the default set for deeper analysis |\n| Quality Gate | Automated checkpoint that blocks code from progressing through the pipeline unless security criteria are met |\n| False Positive | A scan finding that incorrectly identifies secure code as vulnerable, requiring suppression or tuning |\n\n## Tools & Systems\n\n- **CodeQL**: GitHub's semantic code analysis engine with deep dataflow and taint tracking analysis\n- **Semgrep**: Fast, lightweight pattern-matching SAST tool with 3000+ community rules and custom rule support\n- **GitHub Advanced Security**: Platform providing code scanning, secret scanning, and dependency review in GitHub\n- **SARIF Viewer**: VS Code extension for reviewing SARIF results locally during development\n- **GitHub Security Overview**: Organization-level dashboard aggregating security alerts across all repositories\n\n## Common Scenarios\n\n### Scenario: Monorepo with Multiple Languages Needs Unified SAST\n\n**Context**: A platform team manages a monorepo containing Python microservices, TypeScript frontends, and Go infrastructure tools. Security reviews happen manually every quarter, missing vulnerabilities between reviews.\n\n**Approach**:\n1. Configure CodeQL with a matrix strategy covering Python, JavaScript, and Go languages\n2. Add Semgrep with `--config auto` to detect language automatically and apply relevant rulesets\n3. Create path-based triggers so only changed language directories trigger their respective scans\n4. Upload all SARIF results to GitHub Security tab with unique categories per tool and language\n5. Set branch protection requiring all SAST jobs to pass before merge\n6. Schedule weekly full-repository scans to catch issues in unchanged code from newly published CVE patterns\n\n**Pitfalls**: Setting CodeQL to analyze all languages on every PR increases CI time significantly. Use path filters to trigger only relevant language scans. Semgrep's `--config auto` may enable rules that conflict with CodeQL findings, creating duplicate alerts.\n\n### Scenario: Reducing Alert Fatigue from High False Positive Rate\n\n**Context**: After enabling SAST, developers ignore findings because 40% are false positives, undermining the security program.\n\n**Approach**:\n1. Export all current alerts and categorize them as true positive, false positive, or informational\n2. Create a custom CodeQL config excluding noisy query IDs that produce the most false positives\n3. Write `.semgrepignore` patterns for test files, generated code, and vendored dependencies\n4. Establish a weekly triage meeting where security and development leads review new rule additions\n5. Track false positive rate as a metric and target below 15% for developer trust\n\n**Pitfalls**: Over-suppressing rules to reduce noise can create blind spots. Always validate suppressions against the OWASP Top 10 and CWE Top 25 to ensure critical vulnerability classes remain covered.\n\n## Output Format\n\n```\nSAST Pipeline Scan Report\n==========================\nRepository: org\u002Fweb-application\nBranch: feature\u002Fuser-auth-refactor\nScan Date: 2026-02-23\nCommit: a1b2c3d4\n\nCodeQL Results:\n  Language    Queries Run   Findings   Critical   High   Medium\n  javascript  312           4          1          2      1\n  python      287           2          0          1      1\n\nSemgrep Results:\n  Ruleset          Rules Matched   Findings   Errors   Warnings\n  auto             1,847           3          1        2\n  owasp-top-ten    186             2          1        1\n  custom-rules     12              1          0        1\n\nQUALITY GATE: FAILED\n  Blocking findings: 2 Critical\u002FHigh severity issues\n  - [CRITICAL] CWE-89: SQL Injection in src\u002Fapi\u002Fusers.py:47\n  - [HIGH] CWE-79: Cross-site Scripting in src\u002Fcomponents\u002FSearch.tsx:123\n\nAction Required: Fix blocking findings before merge is permitted.\n```\n",{"name":5,"tags":52,"author":56,"domain":46,"license":15,"version":57,"nist_csf":58,"subdomain":53,"description":63,"mitre_attack":64},[53,54,28,41,38,55],"devsecops","cicd","secure-sdlc","mahipal","1.0.0",[59,60,61,62],"PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04","This skill covers integrating Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI\u002FCD pipelines. It addresses configuring automated code scanning on pull requests and pushes, tuning rules to reduce false positives, uploading SARIF results to GitHub Advanced Security, and establishing quality gates that block merges when high-severity vulnerabilities are detected.\n",[65,66,67],"T1195","T1554","T1059.004","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fintegrating-sast-into-github-actions-pipeline","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill integrating-sast-into-github-actions-pipeline",{"tool":82,"command":83},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill integrating-sast-into-github-actions-pipeline",{"tool":85,"command":86},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill integrating-sast-into-github-actions-pipeline","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fintegrating-sast-into-github-actions-pipeline\u002FSKILL.md",true,[90,96,101,107,111,115,121],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"assets\u002Ftemplate.md","ASSET","资产文件",4780,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fintegrating-sast-into-github-actions-pipeline\u002Fassets\u002Ftemplate.md",{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fintegrating-sast-into-github-actions-pipeline\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",1460,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fintegrating-sast-into-github-actions-pipeline\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fstandards.md",2957,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fintegrating-sast-into-github-actions-pipeline\u002Freferences\u002Fstandards.md",{"path":112,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fworkflows.md",5299,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fintegrating-sast-into-github-actions-pipeline\u002Freferences\u002Fworkflows.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",5855,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fintegrating-sast-into-github-actions-pipeline\u002Fscripts\u002Fagent.py",{"path":122,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fprocess.py",13730,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fintegrating-sast-into-github-actions-pipeline\u002Fscripts\u002Fprocess.py",[126,167,176,185,207,233],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":147,"publishedAt":47},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[133,136,139,142],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":168,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":175,"publishedAt":47},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[171,172,173,174],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],{"skillNo":177,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":184,"publishedAt":47},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[180,181,182,183],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":47},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[192,193,194,195,196,197,198,199,200,201,202,203,204,205,206],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":47},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[213],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,218,219,220,221,222,223,224,225,159,160,226,227,228,229,230,231,232],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":249,"publishedAt":47},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[239,242,245,246],{"categoryNo":240,"categoryName":241,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":243,"categoryName":244,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":247,"categoryName":248,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000036","内容创作者",[250,251,252,253,254,255,256,257,156,258,159,160,161,259,260,261,262,263,206,264],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]