<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# SAST Pipeline — API Reference

## Semgrep CLI

```bash
# Full security audit
semgrep scan --config p/security-audit --json .

# Multiple rulesets
semgrep scan --config p/security-audit --config p/owasp-top-ten --config p/cwe-top-25 .

# Custom rules
semgrep scan --config ./custom-rules/ .

# Differential scan (PR only)
semgrep scan --config p/security-audit --baseline-commit origin/main .

# Severity filter
semgrep scan --config p/security-audit --severity ERROR .

# Exclude paths
semgrep scan --config p/security-audit --exclude 'tests/**' --exclude 'vendor/**' .

# SARIF output (GitHub Security tab)
semgrep scan --config p/security-audit --sarif --output results.sarif .

# Verbose with timing
semgrep scan --config p/security-audit --verbose --time .
```

## CodeQL CLI

```bash
# Create database
codeql database create codeql-db --language=python --source-root=.

# Run queries
codeql database analyze codeql-db python-security-extended --format=sarif-latest --output=results.sarif

# Run specific query
codeql database analyze codeql-db codeql/python-queries:Security/CWE-089 --format=csv

# Upgrade database
codeql database upgrade codeql-db
```

## SonarQube Scanner

```bash
# Run SonarScanner
sonar-scanner \
  -Dsonar.projectKey=my-project \
  -Dsonar.sources=src/ \
  -Dsonar.host.url=http://localhost:9000 \
  -Dsonar.token=$SONAR_TOKEN

# Quality gate check
curl -s "http://localhost:9000/api/qualitygates/project_status?projectKey=my-project" \
  -H "Authorization: Bearer $SONAR_TOKEN"
```

## Bandit (Python)

```bash
# Full scan
bandit -r src/ -f json -o bandit-results.json

# High severity only
bandit -r src/ -ll -f json

# Skip specific tests
bandit -r src/ --skip B101,B601

# Configuration file
bandit -r src/ -c .bandit.yml
```

## Key Semgrep Rule Packs

| Pack | Description |
|------|-------------|
| `p/security-audit` | General security audit rules |
| `p/owasp-top-ten` | OWASP Top 10 coverage |
| `p/cwe-top-25` | CWE Top 25 coverage |
| `p/python` | Python-specific security |
| `p/javascript` | JavaScript/TypeScript security |
| `p/golang` | Go security rules |
| `p/java` | Java security rules |
| `p/secrets` | Secret detection rules |
| `p/ci` | CI/CD pipeline security |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | No findings |
| 1 | Findings detected (with --error) |
| 2 | Configuration or runtime error |
