DevOps-Security-Agent-Skills/security/scanning/sast-scanning/references/sast-tools.md

SAST Tools Reference

Tool Comparison

Tool	Languages	License	CI Integration
Semgrep	30+	LGPL/Commercial	Excellent
SonarQube	30+	LGPL/Commercial	Excellent
CodeQL	10+	MIT	GitHub native
Bandit	Python	Apache 2.0	Good
ESLint Security	JavaScript	MIT	Good
Brakeman	Ruby	MIT	Good

Semgrep

# Install
pip install semgrep

# Scan with default rules
semgrep --config auto .

# Scan with specific ruleset
semgrep --config p/owasp-top-ten .
semgrep --config p/security-audit .

# Output JSON
semgrep --config auto --json -o results.json .

Custom Rules

rules:
  - id: sql-injection
    patterns:
      - pattern: |
          $QUERY = "..." + $INPUT + "..."
      - metavariable-regex:
          metavariable: $QUERY
          regex: (?i)(select|insert|update|delete)
    message: "Potential SQL injection"
    severity: ERROR
    languages: [python]

SonarQube

# Scanner CLI
sonar-scanner \
  -Dsonar.projectKey=myproject \
  -Dsonar.sources=src \
  -Dsonar.host.url=http://sonarqube:9000 \
  -Dsonar.token=$SONAR_TOKEN

Quality Gate

# sonar-project.properties
sonar.projectKey=myproject
sonar.sources=src
sonar.tests=tests
sonar.coverage.exclusions=**/test/**
sonar.qualitygate.wait=true

CodeQL

# .github/workflows/codeql.yml
- uses: github/codeql-action/init@v2
  with:
    languages: javascript, python
    
- uses: github/codeql-action/analyze@v2

Bandit (Python)

# Run scan
bandit -r ./src -f json -o bandit-report.json

# With severity filter
bandit -r ./src -ll  # Medium and above

ESLint Security

// .eslintrc
{
  "plugins": ["security"],
  "extends": ["plugin:security/recommended"]
}

CI Integration

# GitHub Actions
- name: Run Semgrep
  uses: returntocorp/semgrep-action@v1
  with:
    config: p/security-audit