skills.rest
AI-Foundry-Core
AI-Foundry-CoreOFFICIAL
Explore all skills by this author →
GitHub

sast-configuration

Configure and tune Semgrep, SonarQube, and CodeQL in CI/CD pipelines.

4|Updated Mar 3, 2026
Search Tags:#security#sast#ci-cd#codeql#sonarqube#semgrep#rule-creation
One-click install
npx skills add https://github.com/AI-Foundry-Core/ril-agents --skill sast-configuration-ai-foundry-core
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-configuration
Source: https://github.com/AI-Foundry-Core/ril-agents/tree/main/plugins/security-scanning/skills/sast-configuration
Command: npx skills add https://github.com/AI-Foundry-Core/ril-agents --skill sast-configuration-ai-foundry-core

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Configure Static Application Security Testing (SAST) tools to streamline vulnerability detection across codebases and accelerate secure delivery.

Core Features & Use Cases

  • SAST setup and tuning for Semgrep, SonarQube, and CodeQL across multiple languages.
  • CI/CD integration to run automated scans on pull requests and builds.
  • Custom rule development to enforce organization security policies and reduce false positives.

Quick Start

Configure Semgrep, SonarQube, and CodeQL in your CI/CD pipeline to begin automated vulnerability scanning.

Frequently Asked Questions about sast-configuration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up SAST tools in a CI/CD pipeline for automated security scans?▼

You can set up SAST tools in a CI/CD pipeline by configuring Semgrep, SonarQube, and CodeQL to run automated vulnerability scans on pull requests and builds, ensuring secure code delivery.

How do I create custom SAST rules to reduce false positives in my codebase?▼

Creating custom SAST rules involves developing tool-specific configurations in Semgrep, SonarQube, or CodeQL to enforce organization security policies, tune vulnerability detection, and reduce false positives.

Does this SAST configuration approach support multi-language repositories?▼

Yes, this SAST configuration approach supports multi-language repositories by applying tool-specific setup and cross-tool coverage with Semgrep, SonarQube, and CodeQL to detect vulnerabilities across diverse codebases.

What is the best way to integrate CodeQL and Semgrep for DevSecOps vulnerability detection?▼

The best way to integrate CodeQL and Semgrep for DevSecOps is by applying cross-tool coverage and pipeline integration to automate vulnerability detection and improve secure coding practices across your codebase.

Can I use SonarQube quality gates alongside Semgrep rules in my build process?▼

Yes, you can use SonarQube quality gates alongside Semgrep rules by integrating both SAST tools into your CI/CD pipeline to enforce security policies and automate vulnerability scanning during builds.

Why are my SAST scans returning too many false positives and how can I tune them?▼

SAST scans return excessive false positives when default rules are too broad, but you can tune them by customizing rules and optimizing performance configurations in Semgrep, SonarQube, or CodeQL.

Related Skills

Explore More Software Engineering Skills→
duanbiao2000duanbiao2000
3

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Community
Advanced
inbharataiinbharatai
22

vuln-scanner

Identify security vulnerabilities in code and configurations via CVE lookups and SAST findings.

Community
Intermediate
Logos-LiberLogos-Liber
17

vulnerability-scanning

Identifies security vulnerabilities in code, dependencies, and container images.

Official
Advanced
amurataamurata
6

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Community
Intermediate