<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-sast-pipeline
description: >-
  Integrate Static Application Security Testing into CI/CD pipelines using Semgrep,
  CodeQL, and SonarQube. Configure rulesets, quality gates, and PR-blocking policies
  to catch vulnerabilities before code merges.
domain: cybersecurity
subdomain: devsecops
tags:
  - sast
  - semgrep
  - codeql
  - sonarqube
  - static-analysis
  - ci-cd
  - shift-left
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Implementing SAST Pipeline

## Overview

Static Application Security Testing (SAST) analyzes source code for vulnerabilities
without executing it. This skill covers integrating SAST tools into CI/CD pipelines
with quality gates that block merges on critical findings. Targets CWE Top 25 and
OWASP Top 10 categories including injection, XSS, and insecure deserialization.

Mode: `[MODE: BLUE]` — Shift-left vulnerability detection through static analysis.

## Prerequisites

| Requirement | Details |
|---|---|
| CI/CD platform | GitHub Actions, GitLab CI, or Jenkins |
| Semgrep CLI (`pip install semgrep`) or CodeQL CLI | Required |
| Python 3.10+ / Node.js 18+ (language-dependent) | Required |
| Repository write access for PR annotations | Required |

## Key Concepts

### Semgrep in GitHub Actions

```yaml
name: SAST Pipeline
on:
  pull_request:
    branches: [main, develop]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep:latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        run: |
          semgrep scan \
            --config p/security-audit \
            --config p/owasp-top-ten \
            --config p/cwe-top-25 \
            --json --output /tmp/semgrep-results.json \
            --severity ERROR \
            --error
      - name: Upload results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: semgrep-results
          path: /tmp/semgrep-results.json
```

### CodeQL Analysis

```yaml
name: CodeQL Analysis
on:
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'

jobs:
  codeql:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    strategy:
      matrix:
        language: [javascript, python]
    steps:
      - uses: actions/checkout@v4
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-extended
      - name: Autobuild
        uses: github/codeql-action/autobuild@v3
      - name: Perform Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"
```

### Custom Semgrep Rules

```yaml
# .semgrep/custom-rules.yml
rules:
  - id: hardcoded-jwt-secret
    patterns:
      - pattern: jwt.encode($PAYLOAD, "...", ...)
    message: "JWT signed with hardcoded secret — use environment variable"
    severity: ERROR
    languages: [python]
    metadata:
      cwe: ["CWE-798"]
      owasp: ["A07:2021"]

  - id: sql-injection-fstring
    patterns:
      - pattern: cursor.execute(f"...{$VAR}...")
    message: "SQL injection via f-string — use parameterized queries"
    severity: ERROR
    languages: [python]
    metadata:
      cwe: ["CWE-89"]
```

### Quality Gate Configuration

```bash
# Fail on critical/high findings
semgrep scan --config p/security-audit --severity ERROR --error .

# Differential scanning (only new findings in PR)
semgrep scan --config p/security-audit --baseline-commit origin/main .

# Exclude test files
semgrep scan --config p/security-audit --exclude 'tests/**' --exclude '*_test.py' .
```

### GitLab CI Integration

```yaml
# .gitlab-ci.yml
sast:
  stage: test
  image: semgrep/semgrep:latest
  script:
    - semgrep scan --config p/security-audit --json --output gl-sast-report.json --error .
  artifacts:
    reports:
      sast: gl-sast-report.json
    when: always
  rules:
    - if: $CI_MERGE_REQUEST_IID
```

## Workflow

### Step 1: Scan Source Code

```bash
node scripts/agent.js --action scan --source-dir ./src/ --output /tmp/sast-results.json
```

### Step 2: Apply Custom Rules

```bash
node scripts/agent.js --action scan --source-dir ./src/ --rules .semgrep/ --output /tmp/sast-custom.json
```

### Step 3: Generate Differential Report

```bash
node scripts/agent.js --action diff --source-dir ./src/ --baseline origin/main --output /tmp/sast-diff.json
```

## Detection

```yaml
title: Sast Pipeline Detection
id: 66b78ab5-65ef-4678-b0fa-c6084326b2ad
status: experimental
description: Detects suspicious activity related to implementing sast pipeline techniques in devsecops context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*sast*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.execution
falsepositives:
  - CI/CD pipeline executing authorized security scanning tools
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Sast Pipeline Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] SAST runs on every pull request
- [ ] Quality gate blocks merges on critical/high findings
- [ ] Custom rules cover project-specific vulnerability patterns
- [ ] Results annotate PRs with inline findings
- [ ] Baseline scanning reduces noise on existing code
- [ ] Scheduled full scans run weekly on default branch
- [ ] SARIF results uploaded to GitHub Security tab

## References

- [Semgrep Documentation](https://semgrep.dev/docs/)
- [CodeQL Documentation](https://codeql.github.com/docs/)
- [OWASP SAST Guide](https://owasp.org/www-community/Source_Code_Analysis_Tools)
- [CWE Top 25](https://cwe.mitre.org/top25/archive/2023/2023_top25_list.html)
