reviewdog

name	reviewdog
description	Automated code review and security linting integration for CI/CD pipelines using reviewdog. Aggregates findings from multiple security and quality tools (SAST, linters, formatters) into unified code review comments on pull requests. Use when: (1) Integrating security scanning into code review workflows, (2) Automating security feedback on pull requests, (3) Consolidating multiple tool outputs into actionable review comments, (4) Enforcing secure coding standards in CI/CD pipelines, (5) Providing inline security annotations during development.
version	0.1.0
maintainer	asrour
category	secsdlc
tags	["code-review","ci-cd","automation","security-feedback","pull-request","linting","sast-integration"]
frameworks	["OWASP","CWE"]
dependencies	{"tools":["reviewdog","git"],"optional":["semgrep","bandit","hadolint","checkov","gitleaks","shellcheck","eslint"]}
references	["https://github.com/reviewdog/reviewdog","https://reviewdog.github.io/"]

Reviewdog - Automated Security Code Review

Overview

Reviewdog is an automated code review tool that integrates security scanning and linting results into pull request review comments. It acts as a universal adapter between various security tools (SAST scanners, linters, formatters) and code hosting platforms (GitHub, GitLab, Bitbucket), enabling seamless security feedback during code review.

Key Capabilities:

• Aggregates findings from multiple security and quality tools
• Posts inline review comments on specific code lines
• Supports 40+ linters and security scanners out-of-the-box
• Integrates with GitHub Actions, GitLab CI, CircleCI, and other CI platforms
• Filters findings to show only new issues in diff (fail-on-diff mode)
• Supports custom rulesets and security policies

Quick Start

Basic reviewdog usage with a security scanner:

# Install reviewdog
go install github.com/reviewdog/reviewdog/cmd/reviewdog@latest

# Run a security scanner and pipe to reviewdog
bandit -r . -f json | reviewdog -f=bandit -reporter=github-pr-review

# Or use with Semgrep
semgrep --config=auto --json | reviewdog -f=semgrep -reporter=local

GitHub Actions integration:

- name: Run reviewdog
  uses: reviewdog/action-setup@v1
- name: Security scan with reviewdog
  env:
    REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: |
    bandit -r . -f json | reviewdog -f=bandit -reporter=github-pr-review

Core Workflow

Step 1: Install reviewdog

Install reviewdog in your CI environment or locally:

# Via Go
go install github.com/reviewdog/reviewdog/cmd/reviewdog@latest


brew install reviewdog


docker pull reviewdog/reviewdog:latest