SASTTriage

When a CI workflow that produces SAST output completes (CodeQL, Semgrep, Bandit, gosec), reads the SARIF or JSON result and triages each finding against the actual repository. Confirmed findings are posted as inline PR review threads with an exploit sketch; dismissed findings are listed with a one-line reason so the dismissal is auditable.

Identifier

sast-triage

Version

1.0.2

Steps

6

Triggers

1

• sast
• security
• triage
• static-analysis
• pull-request
• ci

When it runs

The pipeline

The graph below is the one the workflow opens with in the builder — same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.

1. 01
   SAST CI Workflow Completedtrigger

   The event that starts the run.

2. 02
   Clone Repositorygit.clone

   Shallow-clones the repository at the right ref.

3. 03
   Fetch SARIF Report ⚠️ SET YOUR REPORT URLhttp.request

   Calls an external HTTP endpoint with vault-resolvable headers.

4. 04
   Parse SARIF Findingssarif.ingest

   Parses a scanner report into a deduplicated list of findings, ranked most severe first.

5. 05
   Triage SAST Findingsagent.run

   One agent works the task with its toolkit.

6. 06
   Publish Dismissed Findings Reportreport.publish

   Posts or updates a deduplicated report comment.

The agent

SAST Triage Reviewer

Base type

Code Reviewer

Temperature

0.2

Max iterations

40

Tools

6