GitHub

SecDim offers contextual secure coding training integrating with any SARIF compatible AST tool. This Github Action will take a SARIF file, search the SecDim Catalogue for the relevant challenges, add the link to the challenge in the finding, output a new SARIF file, and upload it as a code scanning alert to the GitHub repository.

The action is freely available on the GitHub Marketplace

Usage

The Github Action can be used in any repository that uses a SARIF compatible AST tool. The action can be added to the repository by creating a CI/CD workflow under .github/workflows/ file:

      - name: Run SecDim Sandbox Action
        uses: secdim/sandbox-action@v1.0.0
        with:
          input_sarif_file: findings.sarif
          output_sarif_file: findings.processed.sarif

The new SARIF file can then be uploaded in any SARIF compatible tool, such as GitHub Code Scanning, SonarQube, Semgrep and any other tool that supports SARIF.