Configure SAST Scans for Secure CI/CD

This skill implements and configures Static Application Security Testing (SAST) across CI/CD pipelines, covering tool selection, scan timing, tool-specific rule configuration, security policy, and performance tuning. Tool selection is matched to the stack (SonarQube for multi-language coverage, Checkmarx for enterprise scale, Semgrep for custom rules), prioritizing CI/CD API and webhook support, balancing false-positive rate against scan speed, and meeting compliance standards like OWASP, CWE, and the SANS Top 25. Scans run at four points: pre-commit hooks for fast, targeted feedback, pull-request scans for comprehensive pre-merge analysis, nightly builds for full-repository scans, and release gates that block critical vulnerabilities before production.

Use it when embedding security scanning into a development workflow across GitHub Actions or Jenkins, with custom Semgrep or CodeQL rules for specific vulnerability classes. It is not a set-and-forget install: the guidance emphasizes ongoing accuracy tuning through baseline establishment, false-positive management, and regular rule updates to keep developer trust while maintaining coverage.

Given a codebase and pipeline, it outputs pipeline configurations for GitHub Actions (SonarCloud plus Semgrep scanning against p/security-audit, p/secrets, and p/owasp-top-ten rulesets, generating and uploading a SARIF report) or Jenkins (parallel SonarQube and Checkmarx stages with a 5-minute quality-gate timeout and a published HTML SAST report), tool configuration files (a sonar-project.properties quality profile, Semgrep custom rules such as a hardcoded-JWT-secret detector and a SQL-injection-risk pattern, and a CodeQL taint-tracking query for unsafe URL redirects), and a security policy file mapping severities to build actions (HIGH and CRITICAL fail the build, MEDIUM requires justification, LOW and INFO auto-approve) with blocking categories (SQL injection, cross-site scripting, command injection, path traversal, hardcoded credentials) versus monitoring-only categories (insecure random, weak cryptography, information disclosure).

name: SAST Security Scan

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  sast-scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
    
    - name: SonarCloud Scan
      uses: SonarSource/sonarcloud-github-action@master
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
    
    - name: Semgrep Scan
      uses: returntocorp/semgrep-action@v1
      with:
        config: >-
          p/security-audit
          p/secrets
          p/owasp-top-ten
        generateSarif: "1"
    
    - name: Upload SARIF results
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: semgrep.sarif
      if: always()

Supports a multi-tool strategy: an enterprise-grade primary scanner (Checkmarx or Veracode) for comprehensive analysis, lightweight tools (Semgrep, ESLint security plugins) for fast feedback, and specialized language analyzers (Bandit for Python, Brakeman for Ruby). Results flow through SARIF for standardized reporting, with automated ticket creation for high-severity findings, Slack or email notification channels, and severity-based SLAs for remediation; performance is managed through differential and incremental scanning, exclusion patterns for third-party dependencies, caching, parallel scanning for multi-module projects, and resource-limited Docker execution.

AppSec and platform engineers rolling out SAST scanning who need working pipeline configs and custom rules, not just tool recommendations - paired with developer-experience practices like clear remediation guidance in scan results, IDE plugin integration for real-time feedback, security training tied to common findings, and a progressive rollout to minimize disruption.