DevSecOps Pipeline Hardening: Automated SAST/DAST & Secret Scanning with Semgrep and TruffleHog

Continuous Integration pipelines must act as automated security quality gates. Relying on manual code reviews to catch SQL injections, hardcoded API tokens, or unsafe deserialization allows vulnerabilities to slip into production environments.

In this second part of our DevSecOps Zero-to-Hero Pipeline Security playlist, we build an automated security scanning pipeline using Semgrep (AST-based SAST) and TruffleHog (high-entropy secret verification), complete with SARIF reporting and inline PR block rules.

---

1. Static Application Security Testing (SAST) with Semgrep

Semgrep is a lightweight static analysis tool that understands Abstract Syntax Trees (ASTs). Unlike legacy regex scanners, Semgrep matches code semantics across Python, C, Go, JavaScript, and TypeScript.

Writing a Custom Semgrep Rule for Unsafe Exec Injection

Here is a custom Semgrep rule (.semgrep/command-injection.yaml) that detects unsafe subprocess execution in Python:

rules:
  - id: python-shell-true-injection
    pattern-either:
      - pattern: subprocess.popen(..., shell=True, ...)
      - pattern: os.system(...)
    message: |
      Detected process execution with shell=True or os.system. 
      This enables command injection if input parameters are user-controlled.
    languages: [python]
    severity: ERROR
    metadata:
      cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command"
      owasp: "A03:2021 - Injection"

---

2. High-Entropy Secret Detection with TruffleHog

Regex-based secret scanners generate excessive false positives. TruffleHog resolves this by analyzing full git commit history, calculating Shannon Entropy, and performing live verification checks against provider endpoints (e.g. testing if an AWS key or Slack token is active).

Running Local TruffleHog Audit

# Scan git history for verified secrets
trufflehog git file://. --only-verified --json

---

3. Integrating Automated Security Scans in GitHub Actions

Below is a complete, production-grade GitHub Actions workflow that runs Semgrep SAST and TruffleHog secret scanning, outputting standardized SARIF reports directly to GitHub Security Code Scanning:

name: Security Automated Audit Gate

on:
  pull_request:
    branches: [ main ]

jobs:
  sast-and-secret-scan:
    name: SAST & Secret Verification
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Fetch all history for commit analysis

      - name: Run TruffleHog Secret Scan
        uses: trufflesecurity/trufflehog-action@main
        with:
          extra_args: --only-verified

      - name: Run Semgrep SAST Scan
        run: |
          python3 -m pip install semgrep
          semgrep scan --config auto --sarif --output semgrep-results.sarif

      - name: Upload SARIF Results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: semgrep-results.sarif

---

4. Summary Checklist for CI/CD Hardening

1. ✅ OIDC Federated Authentication: Zero static AWS/GCP keys in GitHub secrets.
2. ✅ Least Privilege Scoping: Restrict id-token: write and IAM role subjects.
3. ✅ Pre-commit & CI Secret Gates: TruffleHog verified scanning on every pull request.
4. ✅ Custom SAST AST Rules: Semgrep rules enforcing organizational security patterns.