Skip to content

Commit fb6b6cd

Browse files
EvenSolEvenSol
authored
add GHAS (#1589)
1 parent f48b925 commit fb6b6cd

File tree

3 files changed

+155
-0
lines changed

3 files changed

+155
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "maven"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
day: "monday"
8+
time: "03:00"
9+
timezone: "UTC"
10+
open-pull-requests-limit: 5
11+
allow:
12+
- dependency-type: "direct"
13+
reviewers:
14+
- "equinor/security-team"
15+
# Labels help routing and automation
16+
labels:
17+
- "security"
18+
- "dependencies"
19+
# Use groups to bundle related updates (e.g., logging libs) if desired later.
20+
# groups:
21+
# logging:
22+
# patterns:
23+
# - "org.apache.logging.log4j*"
24+
25+
# (Optional future) GitHub Actions ecosystem
26+
- package-ecosystem: "github-actions"
27+
directory: "/"
28+
schedule:
29+
interval: "weekly"
30+
day: "monday"
31+
time: "03:30"
32+
timezone: "UTC"
33+
labels:
34+
- "security"
35+
- "dependencies"

‎.github/workflows/codeql.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: CodeQL Security Analysis
2+
3+
on:
4+
push:
5+
branches: [ "master" ]
6+
pull_request:
7+
branches: [ "master" ]
8+
schedule:
9+
- cron: '0 2 * * 1' # Weekly Monday 02:00 UTC
10+
11+
permissions:
12+
contents: read
13+
security-events: write
14+
actions: read
15+
16+
jobs:
17+
analyze:
18+
name: Analyze (Java)
19+
runs-on: ubuntu-latest
20+
timeout-minutes: 90
21+
steps:
22+
- name: Checkout repository
23+
uses: actions/checkout@v4
24+
25+
- name: Setup Java
26+
uses: actions/setup-java@v4
27+
with:
28+
distribution: temurin
29+
java-version: '11'
30+
31+
- name: Initialize CodeQL
32+
uses: github/codeql-action/init@v3
33+
with:
34+
languages: java
35+
queries: security-extended,security-and-quality
36+
37+
# Manual build ensures full dependency resolution and covers multi-module changes.
38+
- name: Build with Maven (no tests)
39+
run: mvn -B -q clean install -DskipTests
40+
41+
- name: Perform CodeQL Analysis
42+
uses: github/codeql-action/analyze@v3
43+
with:
44+
category: "/language:java"
45+
upload: true
46+
47+
# Optional: fail the job if any results exceed a threshold (future enhancement via SARIF parsing)

‎SECURITY-TRIAGE.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# Security Triage Policy
2+
3+
This document defines how security findings (CodeQL, secret scanning, Dependabot, OWASP Dependency-Check, SpotBugs, PMD, etc.) are triaged and remediated for this repository.
4+
5+
## 1. Sources of Findings
6+
| Source | Type | Location |
7+
|-------|------|----------|
8+
| CodeQL | Static code scanning | GitHub Security tab (Code scanning alerts) |
9+
| Secret Scanning & Push Protection | Credential leaks | GitHub Security tab (Secret scanning alerts) |
10+
| Dependabot Alerts | Vulnerable dependencies | GitHub Security tab (Dependabot alerts) |
11+
| OWASP Dependency-Check | Dependency CVEs (aggregate report) | CI logs / reports |
12+
| SpotBugs / PMD | Quality & potential security issues | CI verify stage |
13+
14+
## 2. Severity Mapping
15+
Severity is based on CVSS (for dependency CVEs) or CodeQL categorization. Adjustments may be made for exploit maturity and exposure.
16+
17+
| Severity | Examples | Action Window |
18+
|----------|----------|---------------|
19+
| Critical | Remote code execution, credential compromise, secret leak (active) | Fix/rotate within 24h |
20+
| High | Deserialization bugs, SQL injection, high CVSS dependency CVE | Fix within 3 business days |
21+
| Medium | Path traversal, SSRF, medium CVSS dependency CVE | Fix within current sprint (≤ 2 weeks) |
22+
| Low | Minor info leak, low CVSS dependency CVE | Backlog / next maintenance window |
23+
| Informational | Style / false positives / non-exploitable | Mark as `wont-fix` or ignore |
24+
25+
## 3. Triage Workflow
26+
1. Alert surfaces (scan, PR annotation, or dashboard).
27+
2. Assign an owner automatically via `CODEOWNERS` or manually (`@equinor/security-team`).
28+
3. Validate: confirm reproducibility, assess exploitability in our context (e.g., library not used at runtime path?).
29+
4. Classify severity (table above) & document rationale in issue or alert comment.
30+
5. Decide disposition:
31+
- Remediate (create PR)
32+
- Mitigate (configuration change / rotation)
33+
- Accept risk (document reason) -> Mark `wont-fix` (CodeQL) or dismiss (Dependabot) with justification.
34+
6. Track SLA: use labels `security` + `severity/<level>` on issues/PRs.
35+
7. Verify fix: ensure updated scan passes & no regression.
36+
37+
## 4. Secret Incidents
38+
If a secret is found:
39+
- Immediately revoke/rotate the credential.
40+
- Purge from history if high sensitivity (use GitHub guidance / BFG Repo-Cleaner).
41+
- Document rotation in internal runbook; NEVER store secrets in repo afterwards.
42+
43+
## 5. False Positives & Suppression
44+
- CodeQL: Prefer updating code or adding precise guards. If not feasible, add a `# codeql[<query-id>]: disable <reason>` comment only where needed.
45+
- Dependabot: Dismiss with `not used at runtime` or `transitive - awaiting upstream` reason.
46+
- OWASP Dependency-Check: Use suppression XML file if persistent FP (store as `dependency-check-suppression.xml`).
47+
48+
## 6. PR Requirements
49+
- All PRs must have successful: build, tests, CodeQL scan, and (if dependency changes) dependency review.
50+
- Security-sensitive changes (crypto, auth, input parsing) require at least 2 reviewers including one from security team.
51+
52+
## 7. Tooling Enhancements (Future)
53+
- Add SARIF gating step to fail CI if Critical/High new issues appear.
54+
- Automate issue creation for CodeQL alerts via webhook/app.
55+
- Integrate metrics export to dashboard (MTTR, open-by-severity, secrets blocked).
56+
57+
## 8. Metrics & Reporting
58+
Track monthly:
59+
- Open alerts by severity (snapshot)
60+
- New vs resolved counts
61+
- MTTR for Critical/High
62+
- Number of secrets blocked by Push Protection
63+
- Dependency update PR merge rate
64+
65+
## 9. Contacts
66+
- Security questions: `@equinor/security-team`
67+
- Maintainers: see `CODEOWNERS`
68+
69+
## 10. Review
70+
Review this policy quarterly or after major process/tooling changes.
71+
72+
---
73+
_Last updated: 2025-10-29_

0 commit comments

Comments
 (0)