sast-configuration

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

SAST Configuration

SAST 配置

Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.

静态应用安全测试（SAST）工具的设置、配置以及自定义规则创建，可实现跨多种编程语言的全面安全扫描。

Overview

概述

This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL. Use this skill when you need to:

Set up SAST scanning in CI/CD pipelines
Create custom security rules for your codebase
Configure quality gates and compliance policies
Optimize scan performance and reduce false positives
Integrate multiple SAST tools for defense-in-depth

本技能提供了设置和配置Semgrep、SonarQube和CodeQL等SAST工具的全面指南。当你需要以下操作时可使用本技能：

在CI/CD流水线中设置SAST扫描
为代码库创建自定义安全规则
配置质量门控与合规策略
优化扫描性能并减少误报
集成多款SAST工具实现纵深防御

Core Capabilities

核心能力

1. Semgrep Configuration

1. Semgrep 配置

Custom rule creation with pattern matching
Language-specific security rules (Python, JavaScript, Go, Java, etc.)
CI/CD integration (GitHub Actions, GitLab CI, Jenkins)
False positive tuning and rule optimization
Organizational policy enforcement

基于模式匹配的自定义规则创建
特定语言的安全规则（Python、JavaScript、Go、Java等）
CI/CD集成（GitHub Actions、GitLab CI、Jenkins）
误报调优与规则优化
组织级策略强制执行

2. SonarQube Setup

2. SonarQube 搭建

Quality gate configuration
Security hotspot analysis
Code coverage and technical debt tracking
Custom quality profiles for languages
Enterprise integration with LDAP/SAML

质量门控配置
安全热点分析
代码覆盖率与技术债务追踪
针对各语言的自定义质量配置文件
与LDAP/SAML的企业级集成

3. CodeQL Analysis

3. CodeQL 分析

GitHub Advanced Security integration
Custom query development
Vulnerability variant analysis
Security research workflows
SARIF result processing

GitHub Advanced Security集成
自定义查询开发
漏洞变体分析
安全研究工作流
SARIF结果处理

Quick Start

快速开始

Initial Assessment

初始评估

Identify primary programming languages in your codebase
Determine compliance requirements (PCI-DSS, SOC 2, etc.)
Choose SAST tool based on language support and integration needs
Review baseline scan to understand current security posture

识别代码库中的主要编程语言
确定合规要求（PCI-DSS、SOC 2等）
根据语言支持和集成需求选择SAST工具
运行基线扫描以了解当前安全状况

Basic Setup

基础设置

bash

undefined

bash

undefined

Semgrep quick start

pip install semgrep semgrep --config=auto --error

SonarQube with Docker

docker run -d --name sonarqube -p 9000:9000 sonarqube:latest

CodeQL CLI setup

gh extension install github/gh-codeql codeql database create mydb --language=python

undefined

gh extension install github/gh-codeql codeql database create mydb --language=python

undefined

Reference Documentation

参考文档

Semgrep Rule Creation - Pattern-based security rule development
SonarQube Configuration - Quality gates and profiles
CodeQL Setup Guide - Query development and workflows

Semgrep 规则创建 - 基于模式的安全规则开发
SonarQube 配置 - 质量门控与配置文件
CodeQL 搭建指南 - 查询开发与工作流

Templates & Assets

模板与资源

semgrep-config.yml - Production-ready Semgrep configuration
sonarqube-settings.xml - SonarQube quality profile template
run-sast.sh - Automated SAST execution script

semgrep-config.yml - 生产就绪的Semgrep配置
sonarqube-settings.xml - SonarQube质量配置文件模板
run-sast.sh - 自动化SAST执行脚本

Integration Patterns

集成模式

CI/CD Pipeline Integration

CI/CD流水线集成

yaml

undefined

yaml

undefined

GitHub Actions example

name: Run Semgrep uses: returntocorp/semgrep-action@v1 with: config: >- p/security-audit p/owasp-top-ten

undefined

name: Run Semgrep uses: returntocorp/semgrep-action@v1 with: config: >- p/security-audit p/owasp-top-ten

undefined

Pre-commit Hook

提交前钩子

bash

undefined

bash

undefined

.pre-commit-config.yaml

repo: https://github.com/returntocorp/semgrep rev: v1.45.0 hooks:
- id: semgrep args: ['--config=auto', '--error']

undefined

repo: https://github.com/returntocorp/semgrep rev: v1.45.0 hooks:
- id: semgrep args: ['--config=auto', '--error']

undefined

Best Practices

最佳实践

Start with Baseline
- Run initial scan to establish security baseline
- Prioritize critical and high severity findings
- Create remediation roadmap
Incremental Adoption
- Begin with security-focused rules
- Gradually add code quality rules
- Implement blocking only for critical issues
False Positive Management
- Document legitimate suppressions
- Create allow lists for known safe patterns
- Regularly review suppressed findings
Performance Optimization
- Exclude test files and generated code
- Use incremental scanning for large codebases
- Cache scan results in CI/CD
Team Enablement
- Provide security training for developers
- Create internal documentation for common patterns
- Establish security champions program

从基线开始
- 运行初始扫描以建立安全基线
- 优先处理严重和高危漏洞
- 创建修复路线图
渐进式采用
- 从安全聚焦规则开始
- 逐步添加代码质量规则
- 仅对关键问题实施拦截
误报管理
- 记录合理的规则抑制
- 为已知安全模式创建允许列表
- 定期复查已抑制的检测结果
性能优化
- 排除测试文件与自动生成代码
- 对大型代码库使用增量扫描
- 在CI/CD中缓存扫描结果
团队赋能
- 为开发者提供安全培训
- 创建常见模式的内部文档
- 建立安全倡导者计划

Common Use Cases

常见用例

New Project Setup

新项目设置

bash

./scripts/run-sast.sh --setup --language python --tools semgrep,sonarqube

bash

./scripts/run-sast.sh --setup --language python --tools semgrep,sonarqube

Custom Rule Development

自定义规则开发

yaml

undefined

yaml

undefined

See references/semgrep-rules.md for detailed examples

rules:

id: hardcoded-jwt-secret pattern: jwt.encode($DATA, "...", ...) message: JWT secret should not be hardcoded severity: ERROR

undefined

rules:

id: hardcoded-jwt-secret pattern: jwt.encode($DATA, "...", ...) message: JWT secret should not be hardcoded severity: ERROR

undefined

Compliance Scanning

合规扫描

bash

undefined

bash

undefined

PCI-DSS focused scan

semgrep --config p/pci-dss --json -o pci-scan-results.json

undefined

semgrep --config p/pci-dss --json -o pci-scan-results.json

undefined

Troubleshooting

故障排除

High False Positive Rate

高误报率

Review and tune rule sensitivity
Add path filters to exclude test files
Use nostmt metadata for noisy patterns
Create organization-specific rule exceptions

复查并调整规则敏感度
添加路径过滤器排除测试文件
对嘈杂模式使用nostmt元数据
创建组织特定的规则例外

Performance Issues

性能问题

Enable incremental scanning
Parallelize scans across modules
Optimize rule patterns for efficiency
Cache dependencies and scan results

启用增量扫描
跨模块并行扫描
优化规则模式以提升效率
缓存依赖与扫描结果

Integration Failures

集成失败

Verify API tokens and credentials
Check network connectivity and proxy settings
Review SARIF output format compatibility
Validate CI/CD runner permissions

验证API令牌与凭证
检查网络连接与代理设置
复查SARIF输出格式兼容性
验证CI/CD运行器权限

Related Skills

Tool Comparison

工具对比

Tool	Best For	Language Support	Cost	Integration
Semgrep	Custom rules, fast scans	30+ languages	Free/Enterprise	Excellent
SonarQube	Code quality + security	25+ languages	Free/Commercial	Good
CodeQL	Deep analysis, research	10+ languages	Free (OSS)	GitHub native

工具	适用场景	语言支持	成本	集成能力
Semgrep	自定义规则、快速扫描	30+种语言	免费/企业版	优秀
SonarQube	代码质量+安全检测	25+种语言	免费/商业版	良好
CodeQL	深度分析、安全研究	10+种语言	免费（开源）	GitHub原生集成

Next Steps

后续步骤

Complete initial SAST tool setup
Run baseline security scan
Create custom rules for organization-specific patterns
Integrate into CI/CD pipeline
Establish security gate policies
Train development team on findings and remediation

完成SAST工具的初始设置
运行基线安全扫描
为组织特定模式创建自定义规则
集成到CI/CD流水线
建立安全门控策略
培训开发团队理解检测结果与修复方法

sast-configuration

Original

Translation

SAST Configuration

SAST 配置

Overview

概述

Core Capabilities

核心能力

1. Semgrep Configuration

1. Semgrep 配置

2. SonarQube Setup

2. SonarQube 搭建

3. CodeQL Analysis

3. CodeQL 分析

Quick Start

快速开始

Initial Assessment

初始评估

Basic Setup

基础设置

Semgrep quick start

Semgrep quick start

SonarQube with Docker

SonarQube with Docker

CodeQL CLI setup

CodeQL CLI setup

Reference Documentation

参考文档

Templates & Assets

模板与资源

Integration Patterns

集成模式

CI/CD Pipeline Integration

CI/CD流水线集成

GitHub Actions example

GitHub Actions example

Pre-commit Hook

提交前钩子

.pre-commit-config.yaml

.pre-commit-config.yaml

Best Practices

最佳实践

Common Use Cases

常见用例

New Project Setup

新项目设置

Custom Rule Development

自定义规则开发

See references/semgrep-rules.md for detailed examples

See references/semgrep-rules.md for detailed examples

Compliance Scanning

合规扫描

PCI-DSS focused scan

PCI-DSS focused scan

Troubleshooting

故障排除

High False Positive Rate

高误报率

Performance Issues

性能问题

Integration Failures

集成失败

Related Skills

相关技能

Tool Comparison

工具对比

Next Steps

后续步骤