/reviewdog

name: reviewdog
description: >
  Automated code review and security linting integration for CI/CD pipelines using reviewdog.
  Aggregates findings from multiple security and quality tools (SAST, linters, formatters) into
  unified code review comments on pull requests. Use when: (1) Integrating security scanning
  into code review workflows, (2) Automating security feedback on pull requests,
  (3) Consolidating multiple tool outputs into actionable review comments, (4) Enforcing
  secure coding standards in CI/CD pipelines, (5) Providing inline security annotations
  during development.
version: 0.1.0
maintainer: asrour
category: secsdlc
tags: [code-review, ci-cd, automation, security-feedback, pull-request, linting, sast-integration]
frameworks: [OWASP, CWE]
dependencies:
  tools: [reviewdog, git]
  optional: [semgrep, bandit, hadolint, checkov, gitleaks, shellcheck, eslint]
references:
  - https://github.com/reviewdog/reviewdog
  - https://reviewdog.github.io/

Reviewdog - Automated Security Code Review

Overview

Reviewdog is an automated code review tool that integrates security scanning and linting results into pull request review comments. It acts as a universal adapter between various security tools (SAST scanners, linters, formatters) and code hosting platforms (GitHub, GitLab, Bitbucket), enabling seamless security feedback during code review.

**Key Capabilities:**

• Aggregates findings from multiple security and quality tools
• Posts inline review comments on specific code lines
• Supports 40+ linters and security scanners out-of-the-box
• Integrates with GitHub Actions, GitLab CI, CircleCI, and other CI platforms
• Filters findings to show only new issues in diff (fail-on-diff mode)
• Supports custom rulesets and security policies

Quick Start

Basic reviewdog usage with a security scanner:

# Install reviewdog
go install github.com/reviewdog/reviewdog/cmd/reviewdog@latest

# Run a security scanner and pipe to reviewdog
bandit -r . -f json | reviewdog -f=bandit -reporter=github-pr-review

# Or use with Semgrep
semgrep --config=auto --json | reviewdog -f=semgrep -reporter=local

GitHub Actions integration:

- name: Run reviewdog
  uses: reviewdog/action-setup@v1
- name: Security scan with reviewdog
  env:
    REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: |
    bandit -r . -f json | reviewdog -f=bandit -reporter=github-pr-review

Core Workflow

Step 1: Install reviewdog

Install reviewdog in your CI environment or locally:

# Via Go
go install github.com/reviewdog/reviewdog/cmd/reviewdog@latest

# Via Homebrew (macOS/Linux)
brew install reviewdog

# Via Docker
docker pull reviewdog/reviewdog:latest

Step 2: Configure Security Tools

Set up the security scanners you want to integrate. Reviewdog supports multiple input formats:

**Supported Security Tools:**

• **SAST**: Semgrep, Bandit, ESLint Security, Brakeman
• **Secret Detection**: Gitleaks, TruffleHog, detect-secrets
• **IaC Security**: Checkov, tfsec, terrascan
• **Container Security**: Hadolint, Trivy, Dockle
• **General Linters**: ShellCheck, yamllint, markdownlint

Step 3: Integrate into CI/CD Pipeline

Add reviewdog to your CI pipeline to automatically post security findings as review comments:

**GitHub Actions Example:**

name: Security Review
on: [pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup reviewdog
        uses: reviewdog/action-setup@v1

      - name: Run Bandit SAST
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          pip install bandit
          bandit -r . -f json | \
            reviewdog -f=bandit \
                     -name="Bandit SAST" \
                     -reporter=github-pr-review \
                     -filter-mode=added \
                     -fail-on-error

**GitLab CI Example:**

security_review:
  stage: test
  script:
    - pip install bandit reviewdog
    - bandit -r . -f json |
        reviewdog -f=bandit
                 -reporter=gitlab-mr-discussion
                 -filter-mode=diff_context
  only:
    - merge_requests

Step 4: Configure Review Behavior

Customize reviewdog's behavior using flags:

# Filter to show only issues in changed lines
reviewdog -filter-mode=diff_context

# Filter to show only issues in added lines
reviewdog -filter-mode=added

# Fail the build if findings are present
reviewdog -fail-on-error

# Set severity threshold
reviewdog -level=warning

Step 5: Review Security Findings

Reviewdog posts findings as inline comments on the pull request:

• **Inline annotations**: Security issues appear directly on affected code lines
• **Severity indicators**: Critical, High, Medium, Low severity levels
• **Remediation guidance**: Links to CWE/OWASP references when available
• **Diff-aware filtering**: Only shows new issues introduced in the PR

Security Considerations

• **API Token Security**: Store GitHub/GitLab tokens in secrets management (GitHub Secrets, GitLab CI/CD variables)
• Never commit tokens to version control
• Use minimum required permissions (read/write on pull requests)
• Rotate tokens regularly

• **Access Control**:
• Configure reviewdog to run only on trusted branches
• Use CODEOWNERS to require security team approval for reviewdog config changes
• Restrict who can modify `.reviewdog.yml` configuration

• **Audit Logging**:
• Log all security findings to SIEM or security monitoring platform
• Track when findings are introduced and resolved
• Monitor for bypassed security checks

• **Compliance**:
• Maintains audit trail of security reviews (SOC2, ISO27001)
• Enforces security policy compliance in code review
• Supports compliance reporting through CI/CD artifacts

• **Safe Defaults**:
• Use `fail-on-error` to block PRs with security findings
• Enable `filter-m