plan files

2026-04-19 22:12:00 -06:00
parent 89b3586030
commit 963e020efa
14 changed files with 238 additions and 0 deletions
@@ -0,0 +1,17 @@
+# Implementation Plan: Semgrep Scanner
+
+## Objective
+Implement the Semgrep SAST (Static Application Security Testing) scanning step as a parallel task in the DAG.
+
+## Requirements
+- Define a task template named `scan-semgrep`.
+- Depend on the `clone-repo` task.
+- Mount the shared PVC at `/workspace`.
+- Run Semgrep with standard or configurable rulesets against the `/workspace` directory.
+- Output findings in SARIF format.
+- Save the output to `/workspace/reports/semgrep.sarif`.
+- Ensure the task exits successfully even if vulnerabilities are found, so Phase 3 aggregation can run (e.g., wrap in a script that returns 0).
+
+## Agent Instructions
+1. Add the `scan-semgrep` template to the `ClusterWorkflowTemplate`.
+2. Wire it into the DAG alongside the other scanners.