Semgrep Code Scan with AI Validation #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Semgrep Code Scan with AI Validation | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| workflow_dispatch: | |
| jobs: | |
| semgrep: | |
| name: Run Semgrep & Validate | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: 3.x | |
| - name: Install Semgrep | |
| run: pip install semgrep | |
| - name: Run Semgrep scan (non-blocking) | |
| run: semgrep ci --config auto || true | |
| - name: Save Semgrep reports | |
| if: always() | |
| run: | | |
| semgrep --config auto --json > semgrep-report.json | |
| semgrep --config auto --text > semgrep-report.txt | |
| - name: Validate findings with Claude AI | |
| if: always() | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| anthropic_api_key: ${{ secrets.ANTROPIC_API_KEY }} | |
| claude_args: '--allowed-tools Read,Grep,Glob,Bash' | |
| prompt: | | |
| Validate the Semgrep security findings in semgrep-report.json. | |
| For EACH finding: | |
| 1. Read the source code file at the reported path | |
| 2. Examine the specific line numbers | |
| 3. Analyze the code context and data flow | |
| 4. Determine: TRUE POSITIVE (real vulnerability) or FALSE POSITIVE (safe code) | |
| Add these fields to each result: | |
| - "is_false_positive": true/false | |
| - "validation_reason": "Detailed explanation" | |
| Consider: | |
| - Is user input properly validated/sanitized? | |
| - Can the vulnerability be exploited? | |
| - Are framework protections in place? | |
| - Is the code path reachable? | |
| After validating ALL findings, use the Bash tool to save the validated JSON: | |
| cat > semgrep-report-validated.json << 'EOF' | |
| {complete validated JSON with all original fields plus validation fields} | |
| EOF | |
| - name: Upload reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: semgrep-reports | |
| path: | | |
| semgrep-report.json | |
| semgrep-report.txt | |
| semgrep-report-validated.json |