Implement SAST tool about rez HOT 3 OPEN

Hey @JeanChristopheMorinPerso and @maxnbk, I'm somewhat familiar with Semgrep and CodeQL. I've had some experience with CNCF TAG security during security assessments and came across a few SAST tools they use. I'm planning to dig up some more info on this. Also, @milind-daftari has experience with enterprise-level SAST solutions like Veracode and SonarQube, we planned to do this SAST integration together. I'll hit you up on Slack to chat more about this.

from rez.

Hi @JeanChristopheMorinPerso, I'm interested to pursue this topic and work on SAST implementation. I would like to work on the Issue if it is not already taken.

from rez.

Hi @Rana-KV! Nobody "started" work on this yet. I use quotes because I did start to look into semgrep to get myself more familiar with it. One of my co-maintainer (@maxnbk) also has experience with semgrep.

Do you have experience with it or with CodeQL or both? Or would like you to suggest another tool instead of these? Feel free to suggest other options and tell us how we could integrate one or multiple SAST tools in our repo!

Also, if you want to have a chat with us about this, please join us on Slack (https://slack.aswf.io, in the #rez channel).

from rez.