Improving USAF DevSecOps with Semgrep - Feasibility Study

Return to Corporation (r2c) will investigate the applicability of its Semgrep offering to AF DevSecOps workflows. Semgrep simplifies static analysis and introduces it into the development workflow without lengthy delays. Semgrep combines the convenient and iterative style of grep with the powerful features of an Abstract Syntax Tree (AST) matcher. It scans your entire project on-demand or automatically in continuous integration and continuous deployment (CI/CD) on every build or commit. During the Phase I effort, r2c will identify an AF end-user and customer for a subsequent Phase II effort to identify and deliver adaptations to Semgrep and integrate it into the AF end user’s CI/CD pipeline.