Automating Static Code Analysis Through CI/CD Pipeline Integration

A generalized process for aggregating SAST tool outputs into issue-tracking software, demonstrated with SonarQube in GitLab

Zachary Wadhams; Ann Marie Reinhold; Clemente Izurieta· 2026· DOI 10.48550/arXiv.2609.00676

The core problem

In the contemporary landscape of software development, securing sensitive data is paramount to safeguarding organizational reputation, preventing financial losses, and protecting individuals from identity theft. This paper addresses the pervasive challenge of identifying and rectifying security vulnerabilities early in the development process, emphasizing the role of Static Application Security Testing (SAST) tools. While SAST tools play a crucial role in detecting vulnerabilities, widespread adoption has been hindered by usability issues, including high false positive rates and a lack of native pipeline support. The authors propose a novel, generalized, and automated process for aggregating SAST tool outputs and integrating them into developers' familiar issue-tracking software. This process aims to streamline the identification and communication of security vulnerabilities during the development lifecycle, facilitating more efficient remediation efforts. The paper demonstrates the successful implementation of the proposed process with the SonarQube SAST tool in a GitLab-based development environment.

The implementation was evaluated in a GitLab-based development environment using SonarQube. The results indicate that the process successfully integrated SAST outputs into the issue-tracking system, providing developers with structured and real-time feedback on security vulnerabilities. Developers were positive about the structured implementation, real-time feedback, and proactive vulnerability management. The automated process reduced the time and effort required to identify and communicate vulnerabilities, leading to more efficient remediation efforts. However, some challenges were noted, including a potential learning curve for developers and tradeoffs between secure coding and workflow disruption. Despite these challenges, the overall positive impact on security awareness and responsiveness suggests that the proposed process holds promise in enhancing the security posture of software development practices.

In the contemporary landscape of software development, securing sensitive data is paramount to safeguarding organizational reputation, preventing financial losses, and protecting individuals from identity theft. This paper addresses the pervasive challenge of identifying and rectifying security vulnerabilities early in the development process, emphasizing the role of Static Application Security Testing (SAST) tools. While SAST tools play a crucial role in detecting vulnerabilities, widespread adoption has been hindered by usability issues, including high false positive rates and a lack of native pipeline support. The authors propose a novel, generalized, and automated process for aggregating SAST tool outputs and integrating them into developers' familiar issue-tracking software. This process aims to streamline the identification and communication of security vulnerabilities during the development lifecycle, facilitating more efficient remediation efforts. The paper demonstrates the successful implementation of the proposed process with the SonarQube SAST tool in a GitLab-based development environment.

The proposed process is designed to be generalized and automated, aggregating outputs from SAST tools and integrating them into issue-tracking software. The implementation uses SonarQube as the SAST tool and GitLab as the development environment. The process involves the following steps:

The paper discusses the implications of the proposed process for software development practices. The integration of SAST tools into CI/CD pipelines and issue-tracking software addresses key usability issues that have hindered widespread adoption, such as high false positive rates and lack of native pipeline support. By automating the aggregation and integration of SAST outputs, the process streamlines vulnerability management and fosters a proactive security culture. The authors acknowledge challenges such as the learning curve and potential workflow disruption, but argue that the benefits of improved security awareness and responsiveness outweigh these tradeoffs. The process is generalized and can be adapted to other tools and environments, making it a valuable contribution to the field of secure software development. Future work could explore the effectiveness of the process with other SAST tools and in different development environments, as well as further mitigate the challenges identified.

CS practitioners and researchers

Opening member content…