Security gates in CI/CD have a bad reputation among engineering teams. They run full-codebase scans on every commit, take 15 to 30 minutes, dump 800 false positives into a dashboard, and inevitably get disabled by team leads trying to meet sprint deadlines.
A modern security gate must satisfy three strict requirements: sub-minute execution, zero false-positive tolerance for blocking builds, and actionable inline diff suggestions that developers can commit with one click.
Diff-Cone Analysis: The Secret to Sub-Minute Turnaround
Scanning an entire 500,000-line repository on every push is wasteful. But scanning only the changed files in a git diff is dangerous because it misses cross-file reachability paths.
The solution is dependency cone analysis: parse the changed files, compute their transitive caller graph, and analyze only the impacted slice. In a typical pull request, this reduces the analysis surface from 10,000 files to fewer than 50 files.
name: ScanDrix Security Gate
on:
pull_request:
branches: [main, master]
jobs:
ast-security-gate:
name: Deterministic AST & Taint Audit
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Run ScanDrix Review Gate
uses: scandrix/review-action@v2
with:
api-key: ${{ secrets.SCANDRIX_TEAM_KEY }}
fail-on: "critical"
post-inline-diffs: true
dry-run-rules: "./.scandrix/rules"Configuring Non-Blocking Dry Run Rules
When introducing a new organizational rule — such as deprecating an internal auth helper or mandating parameterized queries — never set it to block PRs immediately.
Use ScanDrix Drixy rules in Dry Run mode for 14 days. This generates informational comments on pull requests without failing the status check, allowing the team to measure rule precision on real commits before turning on enforcement.
Automated Fix Suggestions Over Static Alerts
The fastest way to get developers to fix a security finding is not an alert message linking to a 20-page CVE report. It is an inline diff patch in the pull request comment.
When developers see the exact replacement lines and can click 'Commit suggestion' right from GitHub's review interface, median time-to-remediation drops from days to under 5 minutes.