The original title is: "Block the merge when a PR ships a vulnerability: a CI security gate with Synapse"

Short summary

The post walks through setting up a CI security gate using Synapse, an open-source Go-based scanner, to block pull requests that introduce high-severity vulnerabilities. A complete GitHub Actions workflow scans for SCA, SAST, secrets, and misconfigurations, uploads SARIF to GitHub Code Scanning, and posts a severity breakdown comment on the PR. The setup runs with three static binaries and no database, making it lightweight enough for any CI runner including air-gapped environments.

• •Synapse CLI gates PR merges by failing CI on high-severity findings across SCA, SAST, secrets, and misconfigs
• •Complete GitHub Actions workflow included with SARIF upload and automated PR remediation comments
• •Runs as three static Go binaries with no server or database; supports offline mode with --offline flag

Generated with AI, which can make mistakes.