Bring the review
to the pull request.
A GitHub App webhook service that reviews changed Python files with Semgrep and reports findings as Check Run annotations. The local demonstration works without a GitHub account, token, tunnel, or webhook secret.
Status: local portfolio demonstration. The prepared deployment mode has not been deployed; this website does not run scans or accept repository uploads.
The problem
Security automation needs to explain what it found, where it found it, and when it could not finish. A scanner failure must not become a reassuring green check. Repository content also crosses a trust boundary: it is input to inspect, not code to execute.
The pipeline
- Verify the webhook with HMAC-SHA256 and validate the immutable commit.
- Bound archive size and extraction, then stage only selected Python source.
- Use service-owned rules rather than PR-controlled configuration or ignore files.
- Run Semgrep and convert findings into line-level Check Run annotations.
- Report scanner and partial-scan errors as failure; unsupported-language or deleted-only changes produce a neutral result.
Try the local demonstration
With Python 3.11–3.13 installed, follow the repository README to clone the project, then run:
python3 -m venv .venv source .venv/bin/activate python -m pip install -r requirements.txt make check
make test runs the offline regression suite with HTTP blocked. make demo scans two source fixtures without executing them. The documented expected result is two high-severity findings for the vulnerable fixture and zero findings for the clean fixture. These are demo expectations, not a live scan result displayed by this site.
What the boundaries protect
The service caps request and archive sizes, limits concurrent local jobs, removes scanner credentials from the subprocess environment, and stages a restricted set of source files. The regression suite covers authentication, hostile archives, isolation, and failure reporting.
Where the boundaries stop
This is a small Python ruleset, not a comprehensive audit. It does not scan dependencies, secrets, JavaScript, or infrastructure. Staging files and stripping credentials is not an OS sandbox. Public hostile repositories require an independently constrained worker, resource limits, and denied network egress. The README documents additional deployment and dependency limitations.