ci: add ThreatCrush security scanning - #1
Merged
Merged
Conversation
…uest devdb has no CI other than the release build, so nothing currently reads the tree for a credential committed by accident or an insecure pattern in the container plumbing. Adds a ThreatCrush scan that gates on critical and high, and publishes SARIF to the Security tab on push and on the weekly schedule. Pull requests are gated by the exit code alone, because a pull request from a fork gets a read-only token and the upload would fail for reasons unrelated to the code. The scanner version is pinned rather than floating: a tool that updates itself in CI is a third party with write access to the build. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017CnhqMwFo6ceywCRLdU2EG
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
.github/workflows/security.yml. devdb has no CI other than the release build, so nothing currently reads the tree for a credential committed by accident or an insecure pattern in the container plumbing.What it does
master, on every pull request, and weekly (rules change more often than this repository does).criticalandhighvia the scanner's exit code.GITHUB_TOKEN, so the upload would fail for reasons unrelated to the code. The exit code is what reports there.Current result: clean
Verified with the published
@profullstack/threatcrush@0.11.9from npm, not a local build.It took a scanner fix to get there
Worth stating plainly, because it is the reason this is worth adding rather than noise. On first run devdb scored 4 findings, all
high, all false positives — every one of them a template string inprofiles.go:dsn: "postgres://{{.user}}:{{.pass}}@{{.host}}:{{.port}}/{{.name}}"The
secret-database-urlrule matched any DSN with a credential segment without checking what was in it, so a tool whose whole job is building connection strings got onehighper profile. That is fixed upstream in profullstack/threatcrush#175 and released as 0.11.9: a DSN whose password slot is an interpolation ({{…}},${…},$VAR,%s) is no longer a credential, whilepostgres://{{.user}}:hunter2@hoststill reports athigh. devdb is now a regression test in that repository.What this does not cover
--deps(OSV.dev advisories against a lockfile) only parses npm and PyPI manifests — there is nogo.sumsupport, so it is left out rather than included as a no-op. This is secret and insecure-pattern scanning over the source only.Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
🤖 Generated with Claude Code
https://claude.ai/code/session_017CnhqMwFo6ceywCRLdU2EG