agentguard-ci/docs/plans/phase2-step2-semgrep.md

Implementation Plan: Semgrep Scanner

Objective

Implement the Semgrep SAST (Static Application Security Testing) scanning step as a parallel task in the DAG.

Requirements

• Define a task template named scan-semgrep.
• Depend on the clone-repo task.
• Mount the shared PVC at /workspace.
• Run Semgrep with standard or configurable rulesets against the /workspace directory.
• Output findings in SARIF format.
• Save the output to /workspace/reports/semgrep.sarif.
• Ensure the task exits successfully even if vulnerabilities are found, so Phase 3 aggregation can run (e.g., wrap in a script that returns 0).

Agent Instructions

1. Add the scan-semgrep template to the ClusterWorkflowTemplate.
2. Wire it into the DAG alongside the other scanners.