Add Scorecard, Trivy misconfig scan, and actionlint#11
Merged
Conversation
Three complementary CI security tools, all SHA-pinned and budgeted to not duplicate what we already run: - pr-misconfig-scan.yml: trivy config on every PR. Catches compose-spec misconfigurations (missing cap_drop, privileged containers, host network mode, mounted docker sockets, etc.) that the image-CVE scan can't see — Trivy's image scan looks at what's INSIDE the image; misconfig looks at HOW the image is run. Posts a sticky PR comment. Informational only; flip --exit-code to gate later once known intentional findings are recorded in .trivyignore. - scorecard.yml: OpenSSF Scorecard weekly + on branch-protection-rule changes. Audits the repo against ~20 OSS security criteria and uploads SARIF to GitHub code-scanning. Catches regressions in branch protection, action pinning, dangerous workflow patterns, etc. - actionlint.yml: lints workflow YAML on PRs that touch .github/workflows/**. Catches shell injection, dead code, unused secrets, deprecated patterns, syntax errors. The binary download is pinned to v1.7.12 and verified with the upstream-published SHA256. All new actions are SHA-pinned with the version in a trailing comment, matching the convention established in the previous hardening PR. helpers:pinGitHubActionDigests in renovate.json will keep them current.
Contributor
Trivy misconfiguration findings (HIGH + CRITICAL)Findings below. Fix the issue or add an ignore entry to |
actionlint (newly added in this branch) caught two SC2155 warnings in the scan() helper: combining `local` with command-substitution masks the assigned command's return value. If slug() failed, the failure would be invisible. Split into separate declarations so any non-zero exit from slug() (or future helpers) propagates as the function's exit code.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three complementary CI security tools, layered on top of the existing Renovate + Trivy image scan + CodeQL stack.
pr-misconfig-scan.ymlcap_drop, privileged containers, host network mode, mounted docker sockets, etc. (HIGH + CRITICAL)scorecard.ymlactionlint.yml.github/workflows/**Why each one
${{ }}-in-bash anti-pattern I fixed manually in Harden CI: SHA-pin actions, isolate PR scripts, pin Trivy installer #10. Cheap insurance.Supply-chain hardening (consistent with previous PRs)
# versioncommentactionlintbinary download is pinned to v1.7.12 AND verified against the upstream-published SHA256 (8aca8db…)v0.70.0in Harden CI: SHA-pin actions, isolate PR scripts, pin Trivy installer #10Local test
actionlintv1.7.12 ran clean against all 5 workflow files locally before pushOperating notes after merge
pr-misconfig-scanis informational (uses--exit-code 0). When you've triaged current findings — either fixed them or added entries to.trivyignore— flip the gate by removing--exit-code 0and adding themisconfigcheck to branch protection.scorecardwill run once on this merge to main and produce a baseline. Future score regressions will be visible in code-scanning.actionlintwill run as a non-required check unless you add it to branch protection's required list.Test plan
actionlintself-validates this PR (lints its own workflow + the two siblings)scan(PR CVE gate) passes trivially — no compose changespush: maintrigger and produces a baseline SARIF