config: add sarif output to semgrep workflow for CodeQL output by IsaacBell · Pull Request #8 · IsaacBell/secure-devtools

IsaacBell · 2026-09-04T13:38:36Z

CodeAnt-AI Description

Publish Semgrep findings to GitHub Code Scanning and add Snyk scan tasks

What Changed

Pull requests and pushes to the main branches now run Semgrep with bundled, default, and security-audit rules
Semgrep results are saved as SARIF and uploaded to GitHub Code Scanning, except for pull requests from forked repositories
Added local tasks for scanning all projects’ dependencies and source code with Snyk
Added a dedicated task for generating Semgrep SARIF reports

Impact

✅ Security findings visible in GitHub Code Scanning
✅ Consistent Semgrep reports for pull requests and branch pushes
✅ Dependency and source-code scans available through Snyk

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

codeant-ai · 2026-09-04T13:38:40Z

Skipping CodeAnt AI review — this PR changes more than 100 files, which usually means a migration, codemod, or vendored drop. Line-level review on diffs this large produces duplicate findings on the same rewrite pattern and drowns out anything that actually matters.

If you still want a review, comment @codeant-ai : review. For better signal, consider splitting the PR into smaller chunks.

github-actions · 2026-09-04T13:38:51Z

+const { CohereClient } = require("cohere-ai");
+
+// ruleid: cohere-hardcoded-api-key-javascript
+const client = new CohereClient({token: "abcdef1234567890"});


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/cohere-hardcoded-api-key/cohere-hardcoded-api-key-javascript.js:generic-api-key:4 >> .gitleaksignore

github-actions · 2026-09-04T13:38:52Z

+import cohere
+
+# ruleid: cohere-hardcoded-api-key-python
+client = cohere.Client(api_key="abcdef1234567890")


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/cohere-hardcoded-api-key/cohere-hardcoded-api-key-python.py:generic-api-key:5 >> .gitleaksignore

github-actions · 2026-09-04T13:38:54Z

@@ -0,0 +1,11 @@
+# ruleid: openai-hardcoded-api-key-ruby
+client = OpenAI::Client.new(access_token: "sk-1234567890abcdef")


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/openai-hardcoded-api-key/openai-hardcoded-api-key-ruby.rb:generic-api-key:2 >> .gitleaksignore

github-actions · 2026-09-04T13:38:55Z

+from google import genai as genai2
+
+# ruleid: gemini-hardcoded-api-key-python
+genai.configure(api_key="AIzaSyA1234567890abcdefghijklmnopqrs")


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/gemini-hardcoded-api-key/gemini-hardcoded-api-key-python.py:generic-api-key:6 >> .gitleaksignore

github-actions · 2026-09-04T13:38:56Z

+genai.configure(api_key="AIzaSyA1234567890abcdefghijklmnopqrs")
+
+# ruleid: gemini-hardcoded-api-key-python
+client = genai2.Client(api_key="AIzaSyA1234567890abcdefghijklmnopqrs")


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/gemini-hardcoded-api-key/gemini-hardcoded-api-key-python.py:generic-api-key:9 >> .gitleaksignore

github-actions · 2026-09-04T13:38:57Z

+from mistralai import Mistral
+
+# ruleid: mistral-hardcoded-api-key-python
+client = Mistral(api_key="mySecretKey123456")


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/mistral-hardcoded-api-key/mistral-hardcoded-api-key-python.py:generic-api-key:5 >> .gitleaksignore

github-actions · 2026-09-04T13:38:58Z

+client = Mistral(api_key="mySecretKey123456")
+
+# ruleid: mistral-hardcoded-api-key-python
+client = MistralClient(api_key="mySecretKey123456")


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/mistral-hardcoded-api-key/mistral-hardcoded-api-key-python.py:generic-api-key:8 >> .gitleaksignore

github-actions · 2026-09-04T13:38:59Z

+const { OpenAI } = require("openai");
+
+// ruleid: openai-hardcoded-api-key-javascript
+const client = new OpenAI({apiKey: "sk-1234567890abcdef"});


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/openai-hardcoded-api-key/openai-hardcoded-api-key-javascript.js:generic-api-key:4 >> .gitleaksignore

github-actions · 2026-09-04T13:39:00Z

+const client = new OpenAI({apiKey: "sk-1234567890abcdef"});
+
+// ruleid: openai-hardcoded-api-key-javascript
+const client2 = new OpenAI({apiKey: "sk-proj-abc123"});


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/openai-hardcoded-api-key/openai-hardcoded-api-key-javascript.js:generic-api-key:7 >> .gitleaksignore

github-actions · 2026-09-04T13:39:02Z

+from openai import OpenAI, AsyncOpenAI
+
+# ruleid: openai-hardcoded-api-key-python
+client = OpenAI(api_key="sk-1234567890abcdef")


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/openai-hardcoded-api-key/openai-hardcoded-api-key-python.py:generic-api-key:5 >> .gitleaksignore

github-actions · 2026-09-04T13:39:03Z

+client = OpenAI(api_key="sk-1234567890abcdef")
+
+# ruleid: openai-hardcoded-api-key-python
+client = AsyncOpenAI(api_key="sk-proj-abc123")


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/openai-hardcoded-api-key/openai-hardcoded-api-key-python.py:generic-api-key:8 >> .gitleaksignore

github-actions · 2026-09-04T13:39:04Z

+const { Mistral } = require("@mistralai/mistralai");
+
+// ruleid: mistral-hardcoded-api-key-javascript
+const client = new Mistral({apiKey: "mySecretKey123456"});


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/mistral-hardcoded-api-key/mistral-hardcoded-api-key-javascript.js:generic-api-key:4 >> .gitleaksignore

github-actions · 2026-09-04T13:39:05Z

+      "args": ["server.py"],
+      "env": {
+        // ruleid: mcp-hardcoded-config-secret-generic
+        "OPENAI_API_KEY": "sk-1234567890abcdef1234567890abcdef"


🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 1aafb3e.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 1aafb3e7054ec095822c8783174b55b69fd9b483:apps/secure-semgrep/rules/ai/ai-best-practices/mcp-hardcoded-config-secret/mcp-hardcoded-config-secret.json:generic-api-key:8 >> .gitleaksignore

codeant-ai · 2026-09-04T13:41:05Z

🏁 CodeAnt Quality Gate Results

Commit: ae4bf110
Scan Time: 2026-09-04 17:52:00 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
IAC	✅ PASSED	Rating S: No issues
SCA (Dependencies)	✅ PASSED	Rating S: No vulnerabilities

View Full Results

codeant-ai · 2026-09-04T16:21:32Z

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Incremental review completed	`114bf44`	Sep 04, 2026 · 17:48	17:49
✅ Incremental review completed	`504d2c5`	Sep 04, 2026 · 16:21	16:24

codeant-ai · 2026-09-04T16:21:32Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

github-advanced-security · 2026-09-04T16:22:09Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

codeant-ai · 2026-09-04T16:23:51Z


 permissions:
  contents: read
+  security-events: write


Suggestion: Fork-originated pull requests receive read-only tokens, so this upload requiring security-events: write fails for the pull requests this workflow also processes. [api mismatch]

Assessment: 🟠 Major · 🔁 Occurrence: Sometimes

Prompt for AI Agent 🤖

This is a comment left during a code review. **Path:** .github/workflows/semgrep.yml **Line:** 13:13 **Comment:** *Api Mismatch: Fork-originated pull requests receive read-only tokens, so this upload requiring `security-events: write` fails for the pull requests this workflow also processes. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

codeant-ai · 2026-09-04T16:24:03Z

CodeAnt Nitpicks

1 code suggestion

1. `always()` runs the uploader after scan or setup failures when `semgrep.sarif` is absent or incomplete, producing a secondary upload failure instead of the scan result.

Incomplete implementation · .github/workflows/semgrep.yml:36-39

IsaacBell added 6 commits September 3, 2026 23:52

feat: add trivy + semgrep

39c59e6

feat: add semgrep rules, scripts

1aafb3e

Merge branch 'main' of https://github.com/IsaacBell/secure-devtools

172a9a3

hotfix: merge conflict artifact

a3f4012

Merge branch 'main' of https://github.com/IsaacBell/secure-devtools

5b38a97

config: add sarif output to semgrep workflow for CodeQL output

a6ffa57

github-actions Bot reviewed Sep 4, 2026

View reviewed changes

IsaacBell added 4 commits September 4, 2026 09:43

fix: remove semgrep's example rule trigger files

7da470e

fix: sha in codeql link

2c7898a

fix: make semgrep output sarif consistently

d9b4255

fix: sarif output from semgrep scans

504d2c5

codeant-ai Bot added the size:S This PR changes 10-29 lines, ignoring generated files label Sep 4, 2026

codeant-ai Bot reviewed Sep 4, 2026

View reviewed changes

IsaacBell added 2 commits September 4, 2026 13:48

fix: semgrep config corrections

114bf44

fix: semgrep config corrections

ae4bf11

IsaacBell merged commit 47d55aa into main Sep 4, 2026
13 of 14 checks passed

		@@ -0,0 +1,11 @@
		# ruleid: openai-hardcoded-api-key-ruby
		client = OpenAI::Client.new(access_token: "sk-1234567890abcdef")

Conversation

IsaacBell commented Sep 4, 2026 • edited by codeant-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CodeAnt-AI Description

What Changed

Impact

Checking Your Pull Request

Talking to CodeAnt AI

Example

Preserve Org Learnings with CodeAnt

Example

Retrigger review

Check Your Repository Health

Uh oh!

codeant-ai Bot commented Sep 4, 2026

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

codeant-ai Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🏁 CodeAnt Quality Gate Results

✅ Overall Status: PASSED

Quality Gate Details

Uh oh!

codeant-ai Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 CodeAnt AI — Review Status

Uh oh!

codeant-ai Bot commented Sep 4, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

github-advanced-security AI commented Sep 4, 2026

What Enabling Code Scanning Means:

Uh oh!

codeant-ai Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codeant-ai Bot commented Sep 4, 2026

CodeAnt Nitpicks

1. always() runs the uploader after scan or setup failures when semgrep.sarif is absent or incomplete, producing a secondary upload failure instead of the scan result.

Uh oh!

Uh oh!

IsaacBell commented Sep 4, 2026 •

edited by codeant-ai Bot

Loading

codeant-ai Bot commented Sep 4, 2026 •

edited

Loading

codeant-ai Bot commented Sep 4, 2026 •

edited

Loading

1. `always()` runs the uploader after scan or setup failures when `semgrep.sarif` is absent or incomplete, producing a secondary upload failure instead of the scan result.