LinkedIn Leverages GitHub Actions, CodeQL, and Semgrep for Code Scanning

2026-02-06 · Source: InfoQ · Field: Technology & Digital — Cybersecurity & Data Privacy, Software Development & Engineering, Cloud Computing & IT Infrastructure · Depth: Intermediate, quick

Summary

LinkedIn has redesigned its static application security testing (SAST) pipeline to ensure consistent and enforceable code scanning across its GitHub-based, multi-repository development environment. This initiative, part of a shift-left strategy, delivers rapid, reliable, and actionable security feedback directly within pull requests, enhancing the security of LinkedIn's code and infrastructure. The new architecture leverages GitHub Actions to orchestrate CodeQL and Semgrep as primary scanning engines, chosen for their complementary coverage and extensibility. Findings are normalized using the SARIF standard and enriched with metadata for clear remediation guidance. To address scale challenges with tens of thousands of repositories, LinkedIn implemented a "stub workflow" in each repository that delegates execution to a centrally maintained workflow, ensuring instant propagation of updates. Enforcement is managed via GitHub repository rulesets that block pull request merges until static analysis completes and vulnerabilities are within acceptable thresholds, with built-in resilience mechanisms to prevent developer workflow disruptions.

Key takeaway

For CTOs and VPs of Engineering managing large, multi-repository GitHub environments, LinkedIn's SAST pipeline redesign offers a blueprint for achieving consistent, scalable code security. You should consider adopting a centralized workflow delegation model via "stub workflows" and leveraging GitHub's native features like Actions and rulesets to embed security early in the development lifecycle without sacrificing developer velocity or introducing bottlenecks.

Key insights

LinkedIn modernized its SAST pipeline using GitHub Actions, CodeQL, and Semgrep for consistent, scalable, and developer-friendly code security.

Principles

• Prioritize developer-first security feedback.
• Ensure extensibility for custom rules and integrations.
• Build resilience to prevent workflow interruptions.

Method

Implement a "stub workflow" in each repository that delegates execution to a centrally maintained workflow, allowing instant propagation of scanning logic and enforcement policies across a multi-repository environment.

In practice

• Use GitHub Actions for SAST orchestration.
• Standardize on SARIF for scan result normalization.
• Employ GitHub repository rulesets for enforcement.

Topics

• Static Application Security Testing
• GitHub Actions
• CodeQL
• Semgrep
• DevSecOps

Code references

• features/actions
• semgrep/semgrep

Best for: CTO, VP of Engineering/Data, Software Engineer, Security Engineer, DevOps Engineer

Related on AIssential

• The Security Architecture of GitHub Agentic Workflow — GitHub's Agentic Workflows employ a "distrustful" security architecture to safely integrate non-deterministic AI agents into CI/CD pipelines.
• scan-for-secrets 0.2 — Version 0.2 of `scan-for-secrets` enhances secret detection with streaming results and flexible scanning options.
• Trailmark turns code into graphs — Code analysis benefits significantly from graph-based reasoning over list-based approaches, especially for security and test quality.
• Nobody Reviewed the Model. They Just Reviewed the Code Around It — ML model loading, especially with "trust_remote_code=True", introduces significant, often overlooked, supply chain security risks.
• AI Threat Readiness Pillar 3: Perform AI Code Analysis Natively in Wiz — AI-driven development necessitates a layered, context-aware code security approach for rapid vulnerability detection and remediation.
• Your GitHub Token Is Now Worth More Than Your AWS Key — AI developers' credentials are now the primary target in supply chain attacks, shifting security focus from models to development environments.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by InfoQ.