After six months of running Semgrep in CI/CD across three major repositories that previously relied on GitHub Advanced Security (GHAS), I feel compelled to document the migration scars and unexpected victories. The catalyst, as it so often is, was pricing arbitrage and the siren song of a unified ruleset. While GHAS provides a decent, integrated experience, the per-commitment cost for a large engineering org began to feel like a tax for convenience we could engineer ourselves.
Our core stack is a mix of Python (FastAPI), TypeScript (React/Node), and some legacy Go services. The initial appeal of Semgrep was the single `.semgrep.yml` policy file we could version control, versus dancing between GitHub Actions workflows, code scanning YAML, and the secret scanning UI. Here's a fragment of our central configuration that replaced about four separate GHAS workflows:
```yaml
rules:
- id: ghsa-mirror
rules:
- r/python.lang.security.audit.insecure-hash-algorithms.md5-insecure-hash-algorithm
- r/js.lang.security.audit.insecure-randomness.insecure-randomness
- id: custom-business-logic-checks
pattern: $USER.integrate($CRM, $ERP, ...)
message: "Direct service integration in handler layer. Use middleware abstraction."
languages: [python]
severity: ERROR
```
The migration wasn't without its middleware horror stories, however.
* **The Secret Scanning Gap:** GHAS's secret scanning is proactive on all pushes. Replicating this required stitching together Semgrep's `secrets` ruleset with a pre-receive hook on our Git server and scheduled repo crawls. We now have more control over false positive allowlists, but we built and now maintain the pipeline—a classic trade-off.
* **Dependency Confusion:** GHAS's Dependabot integration is a cohesive unit. With Semgrep, we run Supply Chain (SCA) rules in CI, but it's a *finding*, not a fix. We had to re-implement automated PR creation using the Semgrep SARIF output and the GitHub API, which took two sprints to get right.
* **The API Clarity Win:** Semgrep's engine is just faster for our mono-repo on self-hosted runners. The GHAS CodeQL build process often felt like waiting for a containerized database to spin up. Semgrep's CLI output is also vastly more scriptable for our custom reporting needs, feeding directly into our internal security dashboard.
The bottom line after 180 days: Our total cost is about 40% lower, and we have deeper control over the rule lifecycle. But we've effectively built a poor man's application security platform in the process. If your team lacks the integration bandwidth to become your own GHAS admin, the switch will be painful. For an API-first shop willing to map every endpoint and process the JSON outputs themselves, however, the flexibility is intoxicating. The true test will be how this patchwork holds up during our next SOC2 audit.
APIs are not magic.