Semgrep Integration Guide

Integrate Semgrep with Vulnetix. Run SAST scans across 35+ languages using community and custom rules, produce SARIF output, and upload for centralized vulnerability management.

Install & scan

$ # Recommended - run without global install
uv run --with semgrep semgrep --version

# Or install globally
pip install semgrep

# Or via Homebrew
brew install semgrep
$ uv run --with semgrep semgrep scan \
  --config auto \
  --sarif --sarif-output=semgrep.sarif .

Run Semgrep in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run Semgrep
  run: |
    pip install semgrep
    semgrep scan --config auto --sarif --sarif-output=semgrep.sarif .

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: semgrep
    path: semgrep.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Semgrep's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Semgrep. Keep running it. Vulnetix sits on top of Semgrep (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Semgrep is strongest at its core category and also carries features in Secret Scanning, SCA, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Semgrep does well

• Fast pattern matching plus taint/dataflow tracking across 35+ languages, with rules that read like the code they match.
• Huge community + Semgrep-maintained registry (thousands of rules) and first-class custom-rule authoring in YAML.
• Clean CI story: SARIF and CycloneDX output, no build required, low-friction pre-merge scanning.

Where Vulnetix adds to it: Vulnetix ingests Semgrep SARIF and keeps it as your SAST engine, then deduplicates it against every other scanner, prioritises with EPSS/CISA KEV/Coalition ESS, adds reachability, versioned VEX and Safe Harbour autofix, the cross-tool layer a single SAST engine does not provide.

No migration, no rip-and-replace. Semgrep keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Semgrep results in Vulnetix

Upload Semgrep SARIF, CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Semgrep documentation ↗  ·  Source repository ↗

Wire Semgrep into your CI/CD pipeline →