Run Semgrep SAST scans in a CI pipeline

Steps

1. Add Semgrep to your CI environment by installing it with pip install semgrep or using the official Docker image; pin the version for reproducible builds
2. Run semgrep scan --config auto (to use Semgrep's recommended rules for detected languages) or specify a custom ruleset with --config path/to/rules.yaml; add --error to fail the pipeline on findings
3. For team workflows, authenticate with SEMGREP_APP_TOKEN set as a CI secret and use semgrep ci to upload results to Semgrep Cloud Platform and enable diff-aware scanning that only reports new findings in a pull request
4. Configure a .semgrepignore file (using .gitignore syntax) to exclude generated code, vendor directories, and test fixtures from scanning
5. Parse SARIF output (--sarif --output results.sarif) and upload it to your code review platform or security dashboard; GitHub natively displays SARIF results as code scanning alerts
6. Write or adapt custom Semgrep rules in YAML to detect project-specific anti-patterns (hardcoded secrets, unsafe deserialization calls, missing authorization checks) and place them in a rules/ directory