bash

安装工具

pip install semgrep bandit brew install gitleaks # macOS git secrets --install # 注册 git 钩子

在项目根目录加入预提交钩子脚本：
```bash
#!/bin/sh
git secrets --pre_commit_hook -- "$@"
gitleaks protect --verbose --staged
semgrep --config=auto --error .

1. CI 集成（GitHub Actions 示例）

   security:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - name: SAST with Semgrep
         uses: semgrep/semgrep-action@v1
         with:
           config: auto
       - name: Secret scan with Gitleaks
         uses: gitleaks/gitleaks-action@v2