Configures and runs Semgrep - pattern-based SAST across 30+ languages with the Semgrep Registry rulesets (`p/owasp-top-ten`, `p/default`, `auto`) plus custom YAML rules; integrates `semgrep ci` for PR-blocking gates with `--baseline-commit` diff-aware scanning, per-finding inline `nosemgrep` suppressions, `--exclude` / `--include` path filters, output formats (`--json` / `--sarif` / `--gitlab-sast` / `--junit-xml`), and severity filter (INFO/WARNING/ERROR). Use when the user runs Semgrep, asks about pattern rules, or needs a low-friction SAST gate without semantic-DB setup.
日本語の概要は準備中です。原文の説明を表示しています。
実行スコア 未検証
インストール方法を見るインストールする前に、エージェントに与えられる指示の中身を確認できます。
Per semgrep.dev/docs/getting-started/quickstart:
Semgrep is a fast pattern-based static analyzer covering 30+
languages with a registry of community + paid rulesets and
straightforward YAML rule authoring. The semgrep ci subcommand
adds CI-aware features (baseline-diff, organization policies,
metrics).
Per semgrep.dev/docs/cli-reference:
"
semgrep scan: Local scans without account requirement; doesn't return failing codes by default.
semgrep ci: Pipeline execution with organization policies, diff-aware scanning, returns failing codes on findings."
.semgrep.yml / .semgrep/ directory or wants
zero-config registry rulesets.Per sg-quick:
# macOS
brew install semgrep
# Linux/macOS
pipx install semgrep
# or
uv tool install semgrep
# Windows (PowerShell)
pipx install semgrep
# Docker (CI-friendly)
docker pull semgrep/semgrep
semgrep scan --config auto
Per sg-cli, --config auto "Auto-fetch rules from
registry based on project." Specific rulesets:
semgrep scan --config p/owasp-top-ten # OWASP Top 10
semgrep scan --config p/default # broad community ruleset
semgrep scan --config p/python p/javascript # multiple
A minimal Semgrep rule in .semgrep.yml:
rules:
- id: hardcoded-jwt-secret
pattern: jwt.sign($PAYLOAD, "...")
message: Hardcoded JWT secret detected
languages: [javascript, typescript]
severity: ERROR
metadata:
cwe: "CWE-798: Use of Hard-coded Credentials"
Pattern operators: pattern, pattern-either, pattern-not,
metavariable-pattern, pattern-inside. Validate rule syntax:
semgrep validate --config .semgrep.yml
(Per sg-cli subcommand list.)
Per sg-cli: "--baseline-commit=VAL - Show only findings
not in specified commit". Diff-aware mode fails only NEW findings on
the PR; pre-existing findings are tracked but don't block - critical
for legacy adoption.
jobs:
semgrep:
runs-on: ubuntu-latest
container:
image: semgrep/semgrep
steps:
- uses: actions/checkout@v5
- run: semgrep ci --baseline-ref=main --sarif --output=semgrep.sarif
- uses: github/codeql-action/upload-sarif@v3
if: always()
with: { sarif_file: semgrep.sarif }
Suppression mechanisms in priority order:
| Mechanism | Example | When to use |
|---|---|---|
Per-line nosemgrep comment | # nosemgrep: hardcoded-password | Justified single-line exception |
nosemgrep block | # nosemgrep: rule-id above a code block | Multi-line exception |
paths.exclude in config | exclude: ["**/*_pb.go"] | Generated files / vendored code |
| Baseline ref | --baseline-commit=main (Step 4) | Legacy debt; ratchet |
| Organization-level rule disable | Semgrep AppSec Platform UI | Team-wide policy |
Justification template (mandatory in code):
# nosemgrep: hardcoded-password
# Reason: Test fixture; password never reaches production runtime
# Reviewer: alice@example.com (2026-05-15)
# Expires: 2026-12-15
TEST_PASSWORD = "test-only-password-do-not-deploy"
Per sg-cli severity filter for triage workflow:
semgrep scan --severity ERROR --json # only critical findings
Cadence: every quarter, audit nosemgrep suppressions for
staleness. Expired ones removed; persistent ones reviewed for
escalation.
Gate on exit 0 = clean, 1 = findings, 2 = fatal error. The full
output-format flags, performance-tuning flags, and complete exit-code
table are in references/cli-reference.md.
| Anti-pattern | Why it fails | Fix |
|---|---|---|
--config=auto everywhere | Rulesets drift; no ownership | Pin specific rulesets (Step 2) |
nosemgrep without justification | Becomes invisible debt | Required justification template (Step 5) |
| No baseline ref | Every legacy finding blocks; team disables | --baseline-commit=main (Step 4) |
semgrep scan in CI | Doesn't return failing exit code by default | Use semgrep ci (Step 1 quote) |
Mix --severity ERROR with --baseline-commit poorly | Can mask real new findings | Severity filter at output stage, not scan stage |
codeql-queries.まだレビューはありません。使ってみた感想をお寄せください。
ログインなしで書き込めます。使ってみた感想、質問、動かなかった環境などを気軽にどうぞ。
まだコメントはありません。最初のコメントを書いてみませんか。
Builds a CI gate that fails the build on **new** WCAG / a11y violations introduced by a PR while grandfathering pre-existing violations on a per-rule / per-page baseline. Aggregates verdicts from axe-core / pa11y / Lighthouse a11y / WAVE / IBM Equal Access scans. Use when a project has accumulated a11y debt and a strict "zero violations" gate would block every PR - the ratchet pattern lets the team ship while preventing regressions.
日本語の概要は準備中です。原文の説明を表示しています。
Workflow skill that builds an A/B-test validity checklist from an experiment proposal, walking the canonical design-correctness gates - pre-registered OEC/power/guardrails, randomization unit + SRM check, assignment integrity, telemetry, peeking discipline, novelty/primacy, post-experiment SRM re-check - into a per-experiment checklist + sign-off form. Use when launching, auditing, or governing an experiment. For pitfall mechanics (guardrails, peeking) see experiment-results-interpreter's references; to read an already-valid result use experiment-results-interpreter; for per-SDK harness tests use experiment-sdk-testing - this gates DESIGN, not SDK code.
日本語の概要は準備中です。原文の説明を表示しています。
The single install-flow skill: the reference contract for the PWA install flow (installability gate fields, `beforeinstallprompt` handshake, per-platform paths - Android WebAPK / iOS Share menu / Firefox no-op - and the `display-mode` post-install signal, in references/install-flow-reference.md) plus the build-an-X workflow that emits the Add-to-Home-Screen suite. Walks the four-stage timeline, emitting one test per gate cell per [web.dev/articles/install-criteria][install-criteria], the deferred-prompt → `prompt()` → `userChoice` chain per [web.dev/articles/customize-install][customize-install], the iOS Safari manual-metadata branch (`apple-touch-icon`) per [web.dev/learn/pwa/installation][learn-pwa], and the post-install `(display-mode: standalone)` MQ assertion. Output: a Playwright spec with per-stage cells plus a coverage matrix. Use when a PWA's manifest, icons, or install handler change, when install conversion drops at an unknown stage, or when triaging a flaky install assertion.
日本語の概要は準備中です。原文の説明を表示しています。
Build-an-X workflow that uses an LLM to map existing tests to spec sections - given a spec doc + the test suite, the LLM identifies which tests cover which sections, surfaces uncovered sections (gap), and recommends specific tests to add. Output is a coverage matrix per spec ID. Scope is mapping tests that already exist and naming the gaps, not authoring tests for new acceptance criteria. Use when a spec doc and a test suite both exist but nobody can say which requirements are actually covered - before a release sign-off, an audit, or a decision about where to spend the next round of test effort.
日本語の概要は準備中です。原文の説明を表示しています。
Generates tests from natural-language specs (acceptance criteria, user stories, requirements) using an LLM, with confidence scoring per test case (LLM self-assessment plus heuristics: assertion quality, naming, completeness), batching uncertain cases for human review, and integration with the team's existing test framework. Use when the user asks to generate unit tests from acceptance criteria, convert user stories to test cases, automate test creation from requirements, or augment a spec-driven test suite with AI-generated stubs that are then curated before merge.
日本語の概要は準備中です。原文の説明を表示しています。
Configures Allure Report (test-runner adapter install, `allure-results` directory wiring, `categories.json` for failure classification, `history-trend.json` retention via the copy-history-between-runs pattern), runs the Allure CLI to convert `allure-results` to a static HTML site, and uploads the report as a CI artifact. Use when the team needs richer test reporting than JUnit XML - step-level attachments, per-test history, retry tracking, and severity / epic / feature labeling across framework-agnostic adapters (pytest, Jest, JUnit, TestNG, NUnit, Mocha). As a rich static HTML report generator, it is the open-source alternative to the sunset ExtentReports (JVM/.NET per-test HTML narrative); for hosted cross-run flakiness analytics rather than a static per-run report use currents-integration.
日本語の概要は準備中です。原文の説明を表示しています。