Project
CI/CD Security Automation
A GitHub Actions workflow that runs SAST, secret scanning, and dependency review against a deliberately vulnerable app — and reports like a human would.
- Problem
- Shift-left tooling is easy to switch on and easy to ignore. The output is noisy, ungrouped, and lands as a wall of annotations no one reads.
- Approach
- A reusable workflow wiring CodeQL (or Semgrep), secret scanning, and dependency review over a known-vulnerable sample application, plus a step that collapses the findings into a short ranked digest posted to the PR.
- Result
- A drop-in workflow other repos can call, and a worked example of tuning the signal-to-noise ratio so developers act on it.
- GitHub Actions
- CodeQL
- Semgrep
- Dependabot
- TypeScript
- OWASP-style sample app
What it will show
- A working pipeline, not a screenshot: the workflow file, the sample app, the PR it comments on.
- Deliberate noise reduction — dedup, severity grouping, “new since last run” framing — because the default output is the reason these programs stall.
- Notes on the gap between “scanner ran” and “risk went down”.
Data sources
A public, intentionally vulnerable sample application. No private code.
Status
Planned.