Review Every PR for Security Bugs.
Automatically. On Your Hardware.

The Workflow — Skeleton

Each stage is a GitHub Actions job. The manual includes the complete YAML with error handling, batch processing, and PR comment formatting.

# .github/workflows/security-review.yml — skeleton
name: GLM 5.2 Security Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    outputs:
      findings: ${{ steps.scan.outputs.findings }}
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        id: scan
        run: |
          semgrep --config=auto --json -q > findings.json
          echo "findings=$(cat findings.json)" >> $GITHUB_OUTPUT

  glm-review:
    needs: semgrep
    runs-on: [self-hosted, gpu]  # Your GPU runner
    if: needs.semgrep.outputs.findings != '[]'
    steps:
      - name: GLM 5.2 Security Review
        run: |
          curl -s http://glm-server:8000/v1/chat/completions \
            -H "Content-Type: application/json" \
            -d "$(python3 build_review_payload.py)" \
            | python3 post_pr_comment.py

The skeleton shows the architecture. The manual ships build_review_payload.py (prompt engineering for security audit), post_pr_comment.py (GitHub API integration), and the full error handling that prevents a single bad finding from crashing the pipeline.

What a GLM 5.2 PR Comment Looks Like

## Security Review — GLM 5.2

**Finding:** Potential SQL injection in `src/api/users.ts:142`
**Semgrep Rule:** `python.sqlalchemy.security.audit.raw-sql`
**Verdict:** TRUE POSITIVE — High Severity

**Why:** User input `req.body.username` is concatenated directly into a
raw SQL query string. No parameterization, no ORM escape.

**Fix:** Replace with parameterized query:
```ts
db.query('SELECT * FROM users WHERE username = ?', [req.body.username])
```

**Confidence:** 0.94

---
*Reviewed by GLM 5.2 on self-hosted infrastructure. No code sent externally.*

FAQ