feat: Add security-scan action #20

Merged

ahmad merged 2 commits from feat/security-scan into main

2026-08-23 11:22:51 +00:00

ahmad commented

2026-08-23 11:12:23 +00:00

Owner

Issue

Closes #19

Problem

No pipeline scans PRs for leaked secrets or vulnerable dependencies, and images ship unscanned. Vendor scanner wrappers are themselves a supply-chain risk (trivy's action and a release were compromised twice in 2026).

Solution

One composite action: gitleaks + osv-scanner + optional trivy image scan. Report-only by default so a repo observes noise before gating; enforce mode fails on findings at or above the threshold. Binaries pinned by version and sha256 from official releases; a scanner error fails the job in every mode. README documents inputs and the canary rollout shape.

Review notes

Verify the three checksums against the upstream release checksum files. First consumer will be a canary repo PR (separate change) before any repo makes it a required check.

Risks and trade-offs

osv-scanner sends dependency names/versions to OSV.dev (documented); gitleaks and trivy run fully local. Report-only default means no protection until a repo opts into enforce — deliberate, to avoid drowning PRs day one.

### Issue Closes #19 ### Problem No pipeline scans PRs for leaked secrets or vulnerable dependencies, and images ship unscanned. Vendor scanner wrappers are themselves a supply-chain risk (trivy's action and a release were compromised twice in 2026). ### Solution One composite action: gitleaks + osv-scanner + optional trivy image scan. Report-only by default so a repo observes noise before gating; enforce mode fails on findings at or above the threshold. Binaries pinned by version and sha256 from official releases; a scanner error fails the job in every mode. README documents inputs and the canary rollout shape. ### Review notes Verify the three checksums against the upstream release checksum files. First consumer will be a canary repo PR (separate change) before any repo makes it a required check. ### Risks and trade-offs osv-scanner sends dependency names/versions to OSV.dev (documented); gitleaks and trivy run fully local. Report-only default means no protection until a repo opts into enforce — deliberate, to avoid drowning PRs day one.

ahmad added 1 commit

2026-08-23 11:12:23 +00:00

feat: Add security-scan action ff2262eef4

gitleaks (secrets), osv-scanner (dependencies) and trivy (image), each
optional, report-only by default with an opt-in enforce mode. Binaries
are pinned by version and sha256 from official releases — the trivy
release pipeline was compromised twice this year, so no vendor wrappers
and no unverified downloads. Scanner errors fail the job in every mode.

ahmad added 1 commit

2026-08-23 11:20:16 +00:00

fix: Treat osv-scanner exit 128 as nothing to scan 6ebd8eccab