diff --git a/.github/workflows/sg-lint.yml b/.github/workflows/sg-lint.yml
new file mode 100644
index 000000000000..8706b9ab18f8
--- /dev/null
+++ b/.github/workflows/sg-lint.yml
@@ -0,0 +1,12 @@
+on: [push]
+
+jobs:
+  sg-lint:
+    runs-on: ubuntu-latest
+    name: Run ast-grep lint
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: ast-grep lint step
+        uses: ast-grep/action@latest
\ No newline at end of file
diff --git a/.github/workflows/test-rust.yml b/.github/workflows/test-rust.yml
index 38dccbd15d23..e90168444ad6 100644
--- a/.github/workflows/test-rust.yml
+++ b/.github/workflows/test-rust.yml
@@ -32,12 +32,6 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Service shouldn't depends on juniper::ID
-        run: bash -c '! grep "juniper::ID" -r ./ee/tabby-webserver/src/service --exclude-./ee/tabby-webserver/src/service/dao.rs'
-
-      - name: Only service can depend on tabby_db
-        run: bash -c '! grep "tabby_db::" -R ./ee/tabby-webserver/src --exclude-dir ./ee/tabby-webserver/src/service'
-
       - name: Install Rust
         uses: actions-rs/toolchain@v1
         with:
diff --git a/rules/only-service-can-depend-tabby-db.yml b/rules/only-service-can-depend-tabby-db.yml
new file mode 100644
index 000000000000..fc9c04db93d0
--- /dev/null
+++ b/rules/only-service-can-depend-tabby-db.yml
@@ -0,0 +1,10 @@
+id: only-service-can-depend-tabby-db
+message: Only service can depend on tabby-db
+severity: error
+language: rust
+files:
+- ./ee/tabby-webserver/src/**
+ignores:
+- ./ee/tabby-webserver/src/service/**
+rule:
+  pattern: tabby_db
\ No newline at end of file
diff --git a/rules/service-shoudnt-depend-on-juniper-id.yml b/rules/service-shoudnt-depend-on-juniper-id.yml
new file mode 100644
index 000000000000..5a3346acfe7a
--- /dev/null
+++ b/rules/service-shoudnt-depend-on-juniper-id.yml
@@ -0,0 +1,10 @@
+id: service-shoudnt-depend-on-juniper-id
+message: Don't use juniper::ID in services.
+severity: error
+language: rust
+files:
+- ./ee/tabby-webserver/src/service/**
+ignores:
+- ./ee/tabby-webserver/src/service/dao.rs
+rule:
+  pattern: juniper::ID
\ No newline at end of file
diff --git a/sgconfig.yml b/sgconfig.yml
new file mode 100644
index 000000000000..790229a4a44d
--- /dev/null
+++ b/sgconfig.yml
@@ -0,0 +1,2 @@
+ruleDirs:
+- rules
\ No newline at end of file