Add a security-scan action (secrets, dependencies, image) #19

New issue

Closed

opened 2026-08-23 11:10:25 +00:00 by ahmad · 0 comments

ahmad commented

2026-08-23 11:10:25 +00:00

Owner

Context

No repository pipeline scans for leaked secrets, vulnerable dependencies, or vulnerable container images. The trivy supply-chain compromises this year also showed why scanner tooling itself must be pinned and checksum-verified rather than pulled via vendor wrappers.

Scope

In: one composite action running gitleaks (secrets, working tree), osv-scanner (dependency advisories), and trivy (container image) — each optional via inputs, binaries pinned by version and sha256, report-only by default with an opt-in enforce mode.
Out: semgrep/SAST (second wave, needs ruleset curation); wiring into app repos (per-repo PRs after a canary).

Acceptance criteria

Given a caller passes defaults, when the action runs on a PR, then secrets and dependency scans report findings without failing the job.
Given enforce is true, when a finding at or above the threshold exists, then the job fails.
Given an image ref, when the action runs, then trivy scans that image with the same report/enforce semantics.
Given any tool download, when the checksum does not match, then the action fails loudly.

### Context No repository pipeline scans for leaked secrets, vulnerable dependencies, or vulnerable container images. The trivy supply-chain compromises this year also showed why scanner tooling itself must be pinned and checksum-verified rather than pulled via vendor wrappers. ### Scope - In: one composite action running gitleaks (secrets, working tree), osv-scanner (dependency advisories), and trivy (container image) — each optional via inputs, binaries pinned by version and sha256, report-only by default with an opt-in enforce mode. - Out: semgrep/SAST (second wave, needs ruleset curation); wiring into app repos (per-repo PRs after a canary). ### Acceptance criteria - [ ] Given a caller passes defaults, when the action runs on a PR, then secrets and dependency scans report findings without failing the job. - [ ] Given enforce is true, when a finding at or above the threshold exists, then the job fails. - [ ] Given an image ref, when the action runs, then trivy scans that image with the same report/enforce semantics. - [ ] Given any tool download, when the checksum does not match, then the action fails loudly.

ahmad referenced this issue from a pull request that will close it,

2026-08-23 11:12:23 +00:00

feat: Add security-scan action #20

ahmad closed this issue

2026-08-23 11:22:51 +00:00

ahmad referenced this issue from a commit

2026-08-23 11:22:53 +00:00

feat: Add security-scan action (#20)

ahmad referenced this issue

2026-08-23 11:26:53 +00:00

fix: Survive scanner findings in report-only mode #21

ahmad referenced this issue from a commit