Add automated security scanning workflows #124

ausbru87 · 2025-10-12T04:39:46Z

Closes #123

Adds automated security scanning to improve supply chain security for air-gapped deployments:

Changes

CodeQL: Daily Go code vulnerability scanning
Trivy: Filesystem and Docker image scanning for dependencies
OpenSSF Scorecard: Weekly security best practices assessment
Enhanced Dependabot: Commit prefixes and patch update filtering

All scan results are uploaded to GitHub Security tab for centralized monitoring.

Testing

Workflows will run on this PR to validate configuration
Docker image scan will run once images are published

github-advanced-security · 2025-10-12T04:40:03Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

- Scan LOW,MEDIUM,HIGH,CRITICAL instead of only HIGH,CRITICAL - Remove Docker image scan (no :latest tag exists)

Enable vuln, secret, and misconfig scanners explicitly

- Build Go binary for linux/amd64 - Build Docker image with buildx - Scan the built image (not filesystem) - Matches coder/coder scanning approach

- Add table format scan to show results in workflow logs - Upload SARIF as artifact for manual inspection - Matches coder/coder artifact upload pattern

Copilot

Pull Request Overview

This PR adds comprehensive automated security scanning workflows to improve supply chain security for air-gapped deployments. The changes include CodeQL vulnerability scanning, Trivy image scanning, OpenSSF Scorecard security assessment, and enhanced Dependabot configuration.

Automated daily security scanning with CodeQL and Trivy
Weekly OpenSSF Scorecard security best practices assessment
Enhanced Dependabot with commit prefixes and patch update filtering

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
CHANGELOG.md	Documents the addition of security scanning workflows and Dependabot enhancements
.github/workflows/security.yaml	Main security workflow with CodeQL and Trivy scanning jobs
.github/workflows/scorecard.yml	OpenSSF Scorecard workflow for security best practices assessment
.github/dependabot.yaml	Enhanced configuration with commit prefixes and patch update filtering

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

.github/workflows/security.yaml

CHANGELOG.md

.github/workflows/scorecard.yml

.github/workflows/security.yaml

…ke and bake.

deansheather · 2025-10-14T15:04:23Z

Makefile


 TAG=$(shell git describe --always)

+build/linux/amd64:


Suggested change

build/linux/amd64:

bin/coder-marketplace-linux-amd64:

You can keep the PHONY (after editing the target name) for simplicity's sake though, otherwise you'll need to specify every Go-related file as a dependency

would it be better to leave PHONY or to use a pattern like one of the following to ensure Make can still optimize by not building if no Go files change?

bin/code-marketplace-linux-amd64: $(wildcard **/*.go) go.mod go.sum

If you think leaving PHONY is simpler and cleaner then I am open just like using Make to optimize builds even in small repos like this.

If you want to do it you'll probably have to use shell find cuz I don't think make's wildcard is very good. But it's probably fine to just leave it as PHONY for this PR

Makefile

.github/workflows/scorecard.yml

.github/workflows/security.yaml

deansheather · 2025-10-14T15:12:16Z

@code-asher could you give this a review and flag anything that's weird for you? I haven't contributed to this repo before so maybe I'm missing something in my reviews

code-asher

Awesome thank you!

code-asher · 2025-10-14T21:14:32Z

.github/dependabot.yaml

+      # Ignore patch updates for all dependencies to reduce PR noise
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-patch


Do we need this? So far the number of updates seem to have been pretty mild. Or we could group updates weekly or something.

grouped weekly. removed ignore

code-asher · 2025-10-14T21:16:03Z

.github/dependabot.yaml

+    commit-message:
+      prefix: "ci"


Not a huge deal, but I think the prefixes may have no use, the changelog is manually curated.

agreed and removed

code-asher · 2025-10-14T21:16:08Z

.github/dependabot.yaml

+    commit-message:
+      prefix: "chore"


agreed and removed

scorecard.yml:24: actions/checkout → v5.0.0 scorecard.yml:29: ossf/scorecard-action → v2.4.3 security.yaml:32: actions/checkout → v5.0.0 (CodeQL job) security.yaml:57: actions/checkout → v5.0.0 (Trivy job) security.yaml:81: aquasecurity/trivy-action → v0.33.1 security.yaml:88: aquasecurity/trivy-action → v0.33.1

removed PHONY alias added wildcard for .go files updated security workflow to use explicit build target vs old alias

removed patch ignore and instead we are grouping all-dependencies updates weekly

deansheather · 2025-10-16T01:16:03Z

Makefile


-build/linux/amd64:
+# Individual build targets for each OS/arch combination
+bin/code-marketplace-mac-amd64: $(wildcard **/*.go) go.mod go.sum


Does wildcard **/*.go work? I can't find any example of this online, seems like people do a lot of workarounds for this.

In coder/coder we define a variable with the result of a $(shell find ...) command

deansheather · 2025-10-16T01:18:14Z

Makefile

-build/linux/amd64:
+# Individual build targets for each OS/arch combination
+bin/code-marketplace-mac-amd64: $(wildcard **/*.go) go.mod go.sum
 	mkdir -p bin


You could maybe just put a $(shell mkdir -p bin) at the top of the file (not in a target) to avoid having to duplicate it in every target

deansheather · 2025-10-16T01:18:35Z

Makefile

-	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-linux-arm64 ./cmd/marketplace/main.go
-	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-windows-amd64 ./cmd/marketplace/main.go
-	CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-windows-arm64 ./cmd/marketplace/main.go
+	CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o $@ ./cmd/marketplace/main.go


If possible would be nice to make the recurring flags here a make variable

ci: add security scanning workflows (#123)

9b0ab3a

ausbru87 added 4 commits October 11, 2025 22:48

ci: scan for all CVE severity levels and remove Docker image scan

351ea5c

- Scan LOW,MEDIUM,HIGH,CRITICAL instead of only HIGH,CRITICAL - Remove Docker image scan (no :latest tag exists)

ci: add explicit scanners to Trivy configuration

980a039

Enable vuln, secret, and misconfig scanners explicitly

ci: build and scan Docker image like coder/coder

9f26520

- Build Go binary for linux/amd64 - Build Docker image with buildx - Scan the built image (not filesystem) - Matches coder/coder scanning approach

ci: add table output and artifact upload for scan visibility

9e22e3a

- Add table format scan to show results in workflow logs - Upload SARIF as artifact for manual inspection - Matches coder/coder artifact upload pattern

ausbru87 requested a review from Copilot October 12, 2025 05:13

Copilot AI reviewed Oct 12, 2025

View reviewed changes

ausbru87 self-assigned this Oct 12, 2025

ausbru87 marked this pull request as ready for review October 12, 2025 05:13

ausbru87 added 2 commits October 11, 2025 23:17

ci: add workflow_dispatch trigger to scorecard for manual testing

9c091a9

revert: remove workflow_dispatch from scorecard

d3b966a

ausbru87 requested a review from jdomeracki-coder October 12, 2025 05:20

deansheather reviewed Oct 12, 2025

View reviewed changes

.github/workflows/security.yaml Outdated Show resolved Hide resolved

CHANGELOG.md Outdated Show resolved Hide resolved

.github/workflows/scorecard.yml Outdated Show resolved Hide resolved

.github/workflows/security.yaml Outdated Show resolved Hide resolved

ausbru87 added 3 commits October 13, 2025 20:48

removed changes from changelog.md

949cdba

updated Make for multiple targets and updated security.yaml to use ma…

6b8d181

…ke and bake.

added sha pinning

c3339da

ausbru87 removed the request for review from jdomeracki-coder October 14, 2025 03:27

deansheather reviewed Oct 14, 2025

View reviewed changes

deansheather requested a review from code-asher October 14, 2025 15:11

code-asher reviewed Oct 14, 2025

View reviewed changes

ausbru87 added 5 commits October 15, 2025 23:23

added explicit build targets for each arch

4769896

removed PHONY alias added wildcard for .go files updated security workflow to use explicit build target vs old alias

added explicit make build command instead of alias to security workflow

ad4db42

removed prefixes due to changelog.md being manually curated

0f66771

removed patch ignore and instead we are grouping all-dependencies updates weekly

reduce potential of credential leak by removing credential persistence

4bac609

deansheather reviewed Oct 16, 2025

View reviewed changes

Add automated security scanning workflows #124

Are you sure you want to change the base?

Add automated security scanning workflows #124

Uh oh!

Conversation

ausbru87 commented Oct 12, 2025

Changes

Testing

Uh oh!

github-advanced-security bot commented Oct 12, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ausbru87 Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

deansheather commented Oct 14, 2025

Uh oh!

code-asher left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ausbru87 Oct 15, 2025 •

edited

Loading