Use VS Code GitHub Copilot Hooks to Run Semgrep in an AEM Project

[PROBLEM] This guide explains how to add repository-level agent hooks that run Semgrep after GitHub Copilot Agent performs a tool action. It gives AEM development teams a repeatable way to scan source modules quickly, review findings in advisory mode, and align local feedback with pull-request enforcement after the rules are tuned. [OVERVIEW] This guide explains how to add repository-level agent hooks that run Semgrep after GitHub Copilot Agent performs a tool action. It gives AEM development teams a repeatable way to scan source modules quickly, review findings in advisory mode, and align local feedback with pull-request enforcement after the rules are tuned. [TRYABLE] 1. Copilot Agent creates or edits project files. 2. VS Code fires the PostToolUse github copilot hook. 3. The hook invokes a repository-owned runner script. 4. The runner scans selected AEM source modules with local Semgrep rules. 5. Findings are printed in the agent debug log and saved as JSON for review. 6. After tuning, ERROR findings can return a nonzero status and block the workflow. [SETUP] Prerequisites VS Code with GitHub Copilot Chat and Agent mode available. Agent Hooks permitted by your organization and workspace trust policy. Semgrep CLI available on the developer workstation or development container. Python 3 for the portable wrapper scripts in this guide. An AEM Maven project, commonly created from the AEM Project Archetype. jq is optional. The supplied scripts do not require it. semgrep --version python --version mvn --version Installation example python -m pip install semgrep Repository layout .github/ hooks/ aem-semgrep.json scripts/ run-semgrep-aem.py semgrep-rules/ aem-java.yml aem-clientlib.yml aem-secrets.yml .semgrepignore .semgrep.yml core/ ui.apps/ ui.config/ ui.frontend/ Keep hook configuration, scripts, and custom rules in source control so developers and CI use the same policy. Do not put credentials or Semgrep tokens in the hook file. 4. Semgrep configuration Rule directory: semgrep-rules/ Run all local YAML-defined rules from the directory: semgrep scan --config semgrep-rules PATH/TO/SOURCE Ignore generated and third-party content: .semgrepignore target/ **/target/ node_modules/ **/node_modules/ ui.apps/target/ ui.content/target/ all/target/ dispatcher/target/ **/generated/ **/dist/ **/coverage/ **/*.min.js If your AEM repository uses different module names, update the scan paths in the runner script. Do not scan Maven build output, npm dependencies, compiled client libraries, or generated packages. [IMPACT] This should help to enforce and catch the security vulnerabilities and any other anti patterns that we would want to avoid in the AEM implementation. Which should definitely help in the overall quality of the code being delivered. [LESSONS] The Semgrep rules included here are intended as a starter pack and should be reviewed, refined, and expanded to align with your project's requirements and security standards. This exercise also highlights the power of GitHub Copilot Hooks and how they can be used alongside GitHub Copilot Skills to automate project-specific validation, security checks, and development workflows. [SAMPLE_OUTPUT] https://gist.github.com/narendragandhi/76ee861ac6957eba15a126f02f0cf503