sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated static security scanning in CI/CD pipelines.

Updated Apr 23, 2026

Search Tags:#ci/cd #sast #security scanning #devsecops #codeql #sonarqube #semgrep

One-click install

npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill sast-configuration-sanketadlak

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: sast-configuration
Source: https://github.com/SanketAdlak/PDMProjectDesign/tree/main/.agents/skills/sast-configuration
Command: npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill sast-configuration-sanketadlak

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires semgrep, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve? Setting up Static Application Security Testing (SAST) tools requires deep knowledge of rule syntax, quality gates, and CI/CD integration, and misconfiguration leads to missed vulnerabilities or overwhelming false positives. ## Core Features & Use Cases - Semgrep Configuration: Create custom pattern-based security rules, tune false positives, and integrate scans into GitHub Actions, GitLab CI, or Jenkins. - SonarQube Setup: Configure quality gates, security hotspot analysis, and custom quality profiles across 25+ languages. - CodeQL Analysis: Build custom queries, run variant analysis, and process SARIF results with GitHub Advanced Security. - Use Case: A DevSecOps engineer needs to enforce PCI-DSS compliance across a Python and JavaScript monorepo. Use this Skill to generate a Semgrep ruleset, wire it into a GitHub Actions pipeline, and establish blocking quality gates for critical findings. ## Quick Start Ask the AI to set up Semgrep and SonarQube scanning for your repository's languages and integrate the scans into your CI/CD pipeline with blocking rules for critical vulnerabilities.

Frequently Asked Questions about sast-configuration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

Can SAST tools scan incrementally for large codebases?▼

Yes, incremental scanning analyzes only changed files or modules, significantly reducing scan time. Combine it with result caching in CI/CD, parallelization across modules, and exclusion of generated code for best performance.