Security CI with Gates

Same minimal project, but scanner execution is separated from policy enforcement.

Pipeline

flowchart LR
    tests[Tests]
    sast[SAST scan] --> sastReport[reports/sast.json]
    sca[SCA scan] --> scaReport[reports/sca.json]
    sastReport --> gates[Security gates]
    scaReport --> gates

Loading

The tests, sast, and sca jobs run independently. After both scanner jobs finish, the gates job runs the SAST gate followed by the SCA gate.

• Tests: pytest
• SAST: Semgrep
• SCA: pip-audit
• SAST gate: blocks WARNING and ERROR severity findings
• SCA gate: blocks any known dependency vulnerability

continue-on-error lets each scanner finish and generate its JSON report. The custom gate then makes the final security decision.

Run locally

pip install -r requirements-dev.txt
python -B -m pytest -q -p no:cacheprovider

mkdir -p reports
semgrep scan --config auto --json --output reports/sast.json src || true
pip-audit -r requirements.txt --format json --output reports/sca.json || true

python scripts/sast_gate.py reports/sast.json
python scripts/sca_gate.py reports/sca.json