Skip to content

Commit 86c36ce

Browse files
Inlet-backInlet-back
committed
Revert "Merge pull request #25 from kc3hack/feat/trivy-code-scanning"
This reverts commit 0c2539c, reversing changes made to 921c1f3.
1 parent 0c2539c commit 86c36ce

File tree

4 files changed

+124
-78
lines changed

4 files changed

+124
-78
lines changed

‎.github/workflows/backend.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,11 @@ jobs:
4646
- name: Run Lint (Ruff)
4747
run: poetry run ruff check .
4848

49-
# Note: Security scanning moved to dedicated security.yml workflow (Trivy)
50-
# Reason: Centralized security checks with GitHub Code Scanning integration
49+
# Decision: Lightweight security check with pip-audit (pinned in pyproject.toml)
50+
# Reason: Fast vulnerability check (seconds) without blocking PR
51+
- name: Security Scan (pip-audit)
52+
run: poetry run pip-audit --require-hashes=false || echo "Vulnerabilities found, see Dependabot for details"
53+
continue-on-error: true
5154

5255
# Decision: Run Pytest even if no tests exist yet (ensure setup works)
5356
# Reason: Validates that the test runner environment is correctly configured.

‎.github/workflows/frontend.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,11 @@ jobs:
4646
- name: Run Lint
4747
run: npm run lint
4848

49-
# Note: Security scanning moved to dedicated security.yml workflow (Trivy)
50-
# Reason: Centralized security checks with GitHub Code Scanning integration
49+
# Decision: Lightweight security check with npm audit (built-in tool)
50+
# Reason: Fast vulnerability check (seconds) without blocking PR
51+
- name: Security Scan (npm audit)
52+
run: npm audit --audit-level=critical || echo "Vulnerabilities found, see Dependabot for details"
53+
continue-on-error: true
5154

5255
- name: Run Build
5356
# This checks for type errors and build capability

‎.github/workflows/security.yml‎

Lines changed: 114 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,76 +1,135 @@
1-
name: Security Scan (Dashboard & Log)
1+
name: Security Gatekeeper (Weekly)
22

3-
# Decision: Use Trivy + GitHub Code Scanning for lightweight, dashboard-integrated security
4-
# Reason: Hackathon-friendly (non-blocking, fast), better UX than Issue accumulation
3+
# Decision: Run heavy scans daily during hackathon, not on PR
4+
# Reason: Syft+Grype takes 3-5min; use Dependabot+built-in tools for PR checks
5+
# Hackathon ends 2026-02-21, so daily scan ensures coverage throughout the event
56
on:
6-
push:
7-
branches: ["main", "develop"]
8-
pull_request:
9-
branches: ["main", "develop"]
107
schedule:
11-
# Daily at 3:00 AM JST for comprehensive scan
8+
# Daily at 3:00 AM JST (18:00 UTC previous day) - Review results each morning
129
- cron: "0 18 * * *"
13-
workflow_dispatch:
10+
workflow_dispatch: # Allow manual trigger anytime
11+
push:
12+
branches: ["main"]
13+
paths:
14+
- ".grype.yaml"
15+
- ".github/workflows/security.yml"
1416

1517
permissions:
1618
contents: read
17-
security-events: write # Required for uploading to Security tab
19+
issues: write # For creating issues on vulnerability detection
1820

1921
jobs:
20-
trivy-scan:
21-
name: Trivy Security Scan
22-
runs-on: ubuntu-latest
23-
timeout-minutes: 5
24-
25-
steps:
26-
- name: Checkout code
27-
uses: actions/checkout@v4
28-
29-
# 1. Console output for immediate feedback in CI logs
30-
- name: Run Trivy (Log Output)
31-
uses: aquasecurity/trivy-action@0.28.0
32-
with:
33-
scan-type: "fs"
34-
scan-ref: "."
35-
format: "table"
36-
exit-code: "0" # Don't fail CI (hackathon-friendly)
37-
severity: "CRITICAL,HIGH"
38-
trivyignores: ".trivyignore"
39-
40-
# 2. SARIF output for GitHub Security tab integration
41-
- name: Run Trivy (SARIF Output)
42-
uses: aquasecurity/trivy-action@0.28.0
43-
with:
44-
scan-type: "fs"
45-
scan-ref: "."
46-
format: "sarif"
47-
output: "trivy-results.sarif"
48-
exit-code: "0" # Don't fail CI
49-
severity: "CRITICAL,HIGH"
50-
trivyignores: ".trivyignore"
51-
52-
# 3. Upload results to GitHub Security tab (visible like Dependabot alerts)
53-
- name: Upload Trivy scan results to GitHub Security tab
54-
uses: github/codeql-action/upload-sarif@v3
55-
if: always() # Upload even if scan found issues
56-
with:
57-
sarif_file: "trivy-results.sarif"
58-
category: "trivy-fs-scan"
59-
60-
secret-scan:
61-
name: Secret Scanning
22+
security-check:
23+
name: Deep Supply Chain & Secret Scan
6224
runs-on: ubuntu-latest
63-
timeout-minutes: 5
25+
timeout-minutes: 10
6426

6527
steps:
6628
- name: Checkout code
6729
uses: actions/checkout@v4
6830
with:
69-
fetch-depth: 0
31+
fetch-depth: 0 # Full history for TruffleHog
7032

71-
- name: TruffleHog Secret Scan
33+
# 1. Secret Scanning (TruffleHog)
34+
# Decision: Full repository scan for scheduled runs (not diff-based)
35+
# Reason: Scheduled scans should audit entire codebase to prevent blind spots
36+
- name: Secret Scan
37+
id: trufflehog
7238
uses: trufflesecurity/trufflehog@v3.82.13
7339
with:
7440
path: ./
41+
# Note: No base/head specified = full repository scan
7542
extra_args: --only-verified
7643
continue-on-error: true
44+
45+
# 2. SBOM Generation (Syft)
46+
- name: Generate SBOM
47+
uses: anchore/sbom-action@v0.17.9
48+
with:
49+
path: .
50+
format: spdx-json
51+
output-file: sbom.spdx.json
52+
53+
# 3. Vulnerability Scan (Grype)
54+
# Decision: Fail on vulnerabilities but don't stop workflow (create issue instead)
55+
# Reason: Need actual failure signal to trigger issue creation
56+
- name: Vulnerability Scan
57+
id: grype
58+
uses: anchore/scan-action@v5.1.0
59+
with:
60+
sbom: sbom.spdx.json
61+
fail-build: true # Exit code 1 on vulnerabilities (enables detection)
62+
severity-cutoff: critical
63+
output-format: table
64+
continue-on-error: true # Don't stop workflow, proceed to issue creation
65+
66+
# 4. Create Issue on Vulnerability Detection
67+
# Decision: Avoid duplicate issues by checking for open security alerts
68+
# Reason: Daily scans would create noise if vulnerabilities persist
69+
- name: Create Security Issue
70+
if: steps.grype.outcome == 'failure' || steps.trufflehog.outcome == 'failure'
71+
uses: actions/github-script@v7
72+
with:
73+
script: |
74+
const grypeFailure = '${{ steps.grype.outcome }}' === 'failure';
75+
const truffleFailure = '${{ steps.trufflehog.outcome }}' === 'failure';
76+
77+
// Fixed title for deduplication
78+
const title = '🔒 Security Alert: Automated Scan Results';
79+
80+
// Check for existing open issue
81+
const existingIssues = await github.rest.issues.listForRepo({
82+
owner: context.repo.owner,
83+
repo: context.repo.repo,
84+
state: 'open',
85+
labels: 'security-scan',
86+
per_page: 1
87+
});
88+
89+
const issues = [];
90+
if (grypeFailure) issues.push('Critical vulnerabilities in dependencies');
91+
if (truffleFailure) issues.push('Secrets detected in repository');
92+
93+
const body = `## Latest Scan: ${new Date().toISOString().split('T')[0]}
94+
95+
**Issues Detected**: ${issues.join(', ')}
96+
**Scan Date**: ${new Date().toISOString()}
97+
**Workflow Run**: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
98+
99+
### Detected Issues
100+
${grypeFailure ? '- ⚠️ **Critical vulnerabilities** in dependencies (see Grype logs)' : ''}
101+
${truffleFailure ? '- 🔑 **Secrets leaked** in repository (see TruffleHog logs)' : ''}
102+
103+
### Action Required
104+
1. Review the workflow logs for detailed information
105+
2. ${grypeFailure ? 'Update affected dependencies or add exceptions to `.grype.yaml` with justification' : ''}
106+
3. ${truffleFailure ? 'Remove secrets from repository and rotate compromised credentials immediately' : ''}
107+
4. Close this issue once resolved
108+
109+
### Notes
110+
- This is a daily automated scan during hackathon
111+
- PRs are checked with lightweight tools (pip-audit/npm audit)
112+
- Dependabot will create PRs for available updates
113+
`;
114+
115+
if (existingIssues.data.length > 0) {
116+
// Update existing issue
117+
const issueNumber = existingIssues.data[0].number;
118+
await github.rest.issues.createComment({
119+
owner: context.repo.owner,
120+
repo: context.repo.repo,
121+
issue_number: issueNumber,
122+
body: `---\n${body}`
123+
});
124+
console.log(`Updated existing issue #${issueNumber}`);
125+
} else {
126+
// Create new issue
127+
await github.rest.issues.create({
128+
owner: context.repo.owner,
129+
repo: context.repo.repo,
130+
title: title,
131+
body: body,
132+
labels: ['security-scan', 'dependencies']
133+
});
134+
console.log('Created new security issue');
135+
}

‎.trivyignore‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

0 commit comments

Comments
 (0)