Hey folks, been running Checkmarx SAST in our GitOps pipeline for about a year now. We trigger it via a GitHub Actions workflow on every PR to our main branch.
Overall, it's solid for catching classic CWE stuff, and the Jenkins/CI integration is well documented. But I'm curious how others have found it compared to tools like Snyk Code, Semgrep, or even SonarQube's SAST? Specifically in a Kubernetes-native, infrastructure-as-code context.
The main friction point for us is the config. Tuning it to reduce false positives without missing real issues feels like a part-time job. Also, getting the results into a developer-friendly format (like a PR comment) required some custom scripting.
```yaml
# Example of our GH Action step to run it
- name: Run Checkmarx Scan
uses: checkmarx-ts/checkmarx-action@v2.0.0
with:
team: 'my-team'
scan_type: 'sast'
project_name: 'my-k8s-app-${{ github.ref }}'
file_filter: '**/*.go,**/*.yaml,**/*.yml'
```
Anyone else automating this in a GitOps flow? How's the container image scanning compare to Trivy? And what's the secrets management detection like versus something dedicated like Gitleaks?
> git commit -m 'done'
git push and pray