I have a simple rule when I work with a team: if a vulnerability makes it into main, the process already failed somewhere upstream. The right place to catch it is on the pull request, before anyone clicks merge.
This post is how I built exactly that gate with Synapse, an open source security scanner written in Go. The end result: open a PR that introduces a vulnerability and CI goes red, a comment lands on the PR telling you what to fix and how, the results show up in the GitHub Code scanning tab, and the merge button stays locked until the issue is dealt with.
Everything below actually runs. There is a public demo repo linked at the end so you can see it, not just read about it.
Why another tool
Fair question. Trivy, Grype and OSV-Scanner are all good and I still use them.
