DevSec Taskrunner

DevSec Taskrunner takes a pasted diff or a repo path, runs git/gitleaks/semgrep through ADK + Gemini 3.5 Flash, ranks findings, and writes a security report you can attach to the change.

Comment

DevSec Taskrunner

Inspiration

Before a merge, security review is still mostly manual: skim the diff, hope you notice a hardcoded key, a weak Terraform block, or SQL built with string interpolation. Scanners help, but they dump noise without ranking or context. Chatbots help, but they leave advice in a conversation and nothing you can attach to the change request.

We wanted something that matches how DevOps work actually runs: take the change, run the checks, decide severity, and finish with a report file—not another wall of text.

That mapped cleanly to the Taskmaster track: a messy multi-step chore at work, turned into a workflow that does the heavy lifting.

What it does

DevSec Taskrunner is a Google ADK agent on Gemini 3.5 Flash that:

  1. Accepts a pasted unified diff / snippet, or a local repository path
  2. Optionally runs tools: git diff, gitleaks, semgrep
  3. Produces a fixed Findings table (severity, file, issue, recommendation, source)
  4. Takes action: saves a durable Markdown report under reports/ (and can upload to Cloud Storage when a bucket is configured)

For the hackathon cloud requirement, the service deploys to Cloud Run via adk deploy cloud_run.

How we built it

  • Agent: ADK LlmAgent with a strict instruction—complete the review, then always call save_security_report
  • Tools (Python callables wrapped by ADK):
    • get_git_diff — uncommitted / staged / branch-vs-base
    • scan_secrets_with_gitleaks
    • scan_code_with_semgrep (clear error if the binary is missing)
    • save_security_report — local Markdown + optional GCS upload
  • Runtime: local adk web / adk run / adk api_server for iteration; Cloud Run for deployment
  • Docs: README spin-up steps, architecture diagram, demo checklist

We exercised it on realistic DevOps material (IaC/CI patterns and injection-style diffs), not only toy snippets.

Challenges we ran into

  1. Going beyond chat — Early builds only returned Findings in the UI. We added save_security_report so every completed review leaves an artifact.
  2. Mixed local toolchains — One scanner was available; another was not. Tools return install hints instead of hard-crashing the workflow.
  3. GCP submission bar — The hackathon requires a Google Cloud service and visible proof in the demo (Console / service URL). Packaging ADK for Cloud Run, billing, and auth became the critical path—not the prompt.
  4. API access by region — The Gemini Developer API can fail depending on caller location; Vertex AI / Cloud Run in a supported region is the reliable path for a live demo.
  5. Scope control — Easy to invent multi-agent “enterprise fleet” features. We cut to one Taskmaster loop: gather → scan → decide → persist.

Accomplishments that we're proud of

  • A review that ends in a saved report, not only a chat reply
  • A stable Findings format operators can paste into a merge discussion
  • Tools that degrade gracefully when a scanner is missing
  • A clear Taskmaster story with ADK + Gemini 3.5 Flash + Cloud Run
  • Reproducible local spin-up and a documented deploy path

What we learned

  • Identity matters: description is for routing; instruction is what the agent obeys. Vague “be helpful” agents stay chatbots.
  • Operators and judges both care about action. Persisting the report changed the product from “security chatbot” to “review task runner.”
  • Local Mac paths ≠ Cloud Run. Production should use pasted diffs, uploaded content, or object storage—not the developer laptop filesystem.
  • Minimum viable for this hackathon is stack-complete (model + ADK + Cloud service), not feature-complete.

What's next for DevSec Taskrunner

  • Webhook from the Git host: open change request → agent posts a short summary and attaches the report
  • Ship scanner binaries in the Cloud Run image for server-side scans
  • Secret Manager for API keys; tighter IAM on the reports bucket
  • Optional false-positive feedback loop so repeated noise gets down-ranked over time

Built With

Share this project:

Updates

Submission history