Add automated security scanning workflows #124

ausbru87 · 2025-10-12T04:39:46Z

Closes #123

Adds automated security scanning to improve supply chain security for air-gapped deployments:

Changes

CodeQL: Daily Go code vulnerability scanning
Trivy: Filesystem and Docker image scanning for dependencies
OpenSSF Scorecard: Weekly security best practices assessment
Enhanced Dependabot: Commit prefixes and patch update filtering

All scan results are uploaded to GitHub Security tab for centralized monitoring.

Testing

Workflows will run on this PR to validate configuration
Docker image scan will run once images are published

github-advanced-security · 2025-10-12T04:40:03Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

- Scan LOW,MEDIUM,HIGH,CRITICAL instead of only HIGH,CRITICAL - Remove Docker image scan (no :latest tag exists)

Enable vuln, secret, and misconfig scanners explicitly

- Build Go binary for linux/amd64 - Build Docker image with buildx - Scan the built image (not filesystem) - Matches coder/coder scanning approach

- Add table format scan to show results in workflow logs - Upload SARIF as artifact for manual inspection - Matches coder/coder artifact upload pattern

Copilot

Pull Request Overview

This PR adds comprehensive automated security scanning workflows to improve supply chain security for air-gapped deployments. The changes include CodeQL vulnerability scanning, Trivy image scanning, OpenSSF Scorecard security assessment, and enhanced Dependabot configuration.

Automated daily security scanning with CodeQL and Trivy
Weekly OpenSSF Scorecard security best practices assessment
Enhanced Dependabot with commit prefixes and patch update filtering

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
CHANGELOG.md	Documents the addition of security scanning workflows and Dependabot enhancements
.github/workflows/security.yaml	Main security workflow with CodeQL and Trivy scanning jobs
.github/workflows/scorecard.yml	OpenSSF Scorecard workflow for security best practices assessment
.github/dependabot.yaml	Enhanced configuration with commit prefixes and patch update filtering

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

.github/workflows/security.yaml

CHANGELOG.md

.github/workflows/scorecard.yml

.github/workflows/security.yaml

…ke and bake.

deansheather · 2025-10-14T15:04:23Z

Makefile


 TAG=$(shell git describe --always)

+build/linux/amd64:


Suggested change

build/linux/amd64:

bin/coder-marketplace-linux-amd64:

You can keep the PHONY (after editing the target name) for simplicity's sake though, otherwise you'll need to specify every Go-related file as a dependency

deansheather · 2025-10-14T15:04:59Z

Makefile


 TAG=$(shell git describe --always)

+build/linux/amd64:


I think every OS/arch should be turned into a target just like this, and the build job should depend on all of them and have no content

deansheather · 2025-10-14T15:05:43Z

.github/workflows/scorecard.yml

+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0


actions/checkout is currently at v5.0.0

deansheather · 2025-10-14T15:06:00Z

.github/workflows/scorecard.yml

+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0


ossf/scorecard-action is currently at v2.4.3

deansheather · 2025-10-14T15:06:53Z

.github/workflows/security.yaml

+          echo "image=code-marketplace:scan" >> "$GITHUB_OUTPUT"
+
+      - name: Run Trivy vulnerability scanner (table output for logs)
+        uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # 0.28.0


aquasecurity/trivy-action is currently at v0.33.1. Also missing the v in the comment

deansheather · 2025-10-14T15:07:02Z

.github/workflows/security.yaml

+          severity: "LOW,MEDIUM,HIGH,CRITICAL"
+
+      - name: Run Trivy vulnerability scanner (SARIF output for GitHub)
+        uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # 0.28.0


deansheather · 2025-10-14T15:08:09Z

.github/workflows/security.yaml

+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0


deansheather · 2025-10-14T15:12:16Z

@code-asher could you give this a review and flag anything that's weird for you? I haven't contributed to this repo before so maybe I'm missing something in my reviews

code-asher

Awesome thank you!

code-asher · 2025-10-14T21:14:32Z

.github/dependabot.yaml

+      # Ignore patch updates for all dependencies to reduce PR noise
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-patch


Do we need this? So far the number of updates seem to have been pretty mild. Or we could group updates weekly or something.

code-asher · 2025-10-14T21:16:03Z

.github/dependabot.yaml

+    commit-message:
+      prefix: "ci"


Not a huge deal, but I think the prefixes may have no use, the changelog is manually curated.

code-asher · 2025-10-14T21:16:08Z

.github/dependabot.yaml

+    commit-message:
+      prefix: "chore"


ci: add security scanning workflows (#123)

9b0ab3a

ausbru87 added 4 commits October 11, 2025 22:48

ci: scan for all CVE severity levels and remove Docker image scan

351ea5c

- Scan LOW,MEDIUM,HIGH,CRITICAL instead of only HIGH,CRITICAL - Remove Docker image scan (no :latest tag exists)

ci: add explicit scanners to Trivy configuration

980a039

Enable vuln, secret, and misconfig scanners explicitly

ci: build and scan Docker image like coder/coder

9f26520

- Build Go binary for linux/amd64 - Build Docker image with buildx - Scan the built image (not filesystem) - Matches coder/coder scanning approach

ci: add table output and artifact upload for scan visibility

9e22e3a

- Add table format scan to show results in workflow logs - Upload SARIF as artifact for manual inspection - Matches coder/coder artifact upload pattern

ausbru87 requested a review from Copilot October 12, 2025 05:13

Copilot AI reviewed Oct 12, 2025

View reviewed changes

ausbru87 self-assigned this Oct 12, 2025

ausbru87 marked this pull request as ready for review October 12, 2025 05:13

ausbru87 added 2 commits October 11, 2025 23:17

ci: add workflow_dispatch trigger to scorecard for manual testing

9c091a9

revert: remove workflow_dispatch from scorecard

d3b966a

ausbru87 requested a review from jdomeracki-coder October 12, 2025 05:20

deansheather reviewed Oct 12, 2025

View reviewed changes

.github/workflows/security.yaml Outdated Show resolved Hide resolved

CHANGELOG.md Outdated Show resolved Hide resolved

.github/workflows/scorecard.yml Outdated Show resolved Hide resolved

.github/workflows/security.yaml Outdated Show resolved Hide resolved

ausbru87 added 3 commits October 13, 2025 20:48

removed changes from changelog.md

949cdba

updated Make for multiple targets and updated security.yaml to use ma…

6b8d181

…ke and bake.

added sha pinning

c3339da

ausbru87 removed the request for review from jdomeracki-coder October 14, 2025 03:27

deansheather reviewed Oct 14, 2025

View reviewed changes

deansheather requested a review from code-asher October 14, 2025 15:11

code-asher reviewed Oct 14, 2025

View reviewed changes

Add automated security scanning workflows #124

Are you sure you want to change the base?

Add automated security scanning workflows #124

Conversation

ausbru87 commented Oct 12, 2025

Changes

Testing

Uh oh!

github-advanced-security bot commented Oct 12, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

deansheather commented Oct 14, 2025

Uh oh!

code-asher left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants