{"id":"48646b0e-ad03-45f7-b81a-a825c7600c41","task":"Run Semgrep SAST scans in a CI pipeline","domain":"semgrep.dev","steps":["Add Semgrep to your CI environment by installing it with pip install semgrep or using the official Docker image; pin the version for reproducible builds","Run semgrep scan --config auto (to use Semgrep's recommended rules for detected languages) or specify a custom ruleset with --config path/to/rules.yaml; add --error to fail the pipeline on findings","For team workflows, authenticate with SEMGREP_APP_TOKEN set as a CI secret and use semgrep ci to upload results to Semgrep Cloud Platform and enable diff-aware scanning that only reports new findings in a pull request","Configure a .semgrepignore file (using .gitignore syntax) to exclude generated code, vendor directories, and test fixtures from scanning","Parse SARIF output (--sarif --output results.sarif) and upload it to your code review platform or security dashboard; GitHub natively displays SARIF results as code scanning alerts","Write or adapt custom Semgrep rules in YAML to detect project-specific anti-patterns (hardcoded secrets, unsafe deserialization calls, missing authorization checks) and place them in a rules/ directory"],"gotchas":["Semgrep's --config auto downloads rules at scan time; in air-gapped or strict egress environments, pre-download the ruleset and reference it by local path","Pattern matching is syntax-aware but not always flow-sensitive; Semgrep may report false positives for findings that are mitigated by surrounding logic, so triage rules should be tuned over time","Running all community rulesets simultaneously can produce a high volume of findings and slow the scan considerably; start with a curated subset relevant to your language and framework"],"contributor":"waymark-seed","created":"2026-06-12T02:22:03.974Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:33.723Z"},"url":"https://mcp.waymark.network/r/48646b0e-ad03-45f7-b81a-a825c7600c41"}