mirror of https://github.com/abhigyanpatwari/GitNexus.git synced 2026-08-28 05:25:25 +00:00

ci(security): add automated security and vulnerability scans (#1297 )

* ci(security): add CodeQL SAST workflow for JS/TS and Python

CodeQL analyzes both languages on PR, main push, and weekly schedule.
Findings upload to the Security tab as SARIF. Advisory only on
introduction; promote to required check after baseline triage.

Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U1)

* ci(security): add Dependency Review PR gate

Blocks PRs introducing high+ severity dependency vulnerabilities.
Posts inline summary comment on failure. Required-check candidate
after one week of clean runs.

Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U2)

* ci(security): add Gitleaks secret scanning

PR runs scan the diff; main pushes scan full history.
Defense-in-depth on top of GitHub native push protection
(documented as a recommended Settings toggle in SECURITY.md).

Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U3)

* ci(security): add OpenSSF Scorecard workflow

Weekly + on main push. SARIF uploads to Security tab; public
badge URL resolves after first scheduled run lands.

Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U4)

* ci(security): add zizmor workflow lint

Lints .github/workflows/** for known Actions security misconfigurations
(unpinned actions, dangerous interpolation, missing permissions).
Triggered only on PRs touching .github/**.

Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U5)

* ci(security): add Trivy container image scanning

Builds Dockerfile.cli and Dockerfile.web, then scans images for
HIGH/CRITICAL CVEs. Findings record-only on Security tab; not
PR-blocking. Weekly schedule + main push for freshness.

Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U6)

* docs(security): add SECURITY.md policy and Scorecard badge

Vulnerability disclosure policy points to GitHub Private Vulnerability
Reporting. Documents in-CI scans landed in this branch and recommended
admin actions for forks.

Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U7)

* fix(review): apply autofix feedback

- CodeQL paths-ignore: replace brace expansion (parser.{c,js}) with two
  explicit entries — CodeQL uses .gitignore-style globs that do NOT support
  brace expansion, so the original pattern matched no files.
- Trivy: pin aquasecurity/trivy-action from @master to @0.28.0 — mutable
  refs are a supply-chain risk and are exactly what zizmor (added in this
  same plan) is meant to flag.

ce-code-review run: /tmp/compound-engineering/ce-code-review/20260503-104259-279c3bc4/

* docs(review): record residual review findings

ce-code-review autofix run flagged three downstream-resolver items
that are not blockers but should land before promoting any of the new
security workflows to required PR checks.

Source: /tmp/compound-engineering/ce-code-review/20260503-104259-279c3bc4/

* fix(ci-security): address all zizmor + dependency-review violations

Resolves all GitHub Advanced Security findings on PR #1297:

- Add 'persist-credentials: false' to actions/checkout in 5 workflows
  (codeql, dependency-review, gitleaks, trivy, workflow-lint). Prevents
  the GITHUB_TOKEN from persisting in .git/config for downstream steps
  to read. Scorecard already had it.
- Pin every net-new third-party Action to a commit SHA (was: major-tag
  refs flagged by zizmor as 'unpinned action reference'):
    github/codeql-action -> v3.35.3 (0daab03)
    actions/dependency-review-action -> v4.9.0 (2031cfc)
    gitleaks/gitleaks-action -> v2.3.9 (ff98106)
    ossf/scorecard-action -> v2.4.3 (4eaacf0)
    docker/build-push-action -> v6.19.2 (10e90e3)
- Bump aquasecurity/trivy-action 0.28.0 -> 0.36.0 (ed142fd). Versions
  < 0.35.0 are flagged by GHSA-69fq-xp46-6x23 (briefly compromised
  supply chain). Caught by Dependency Review on the introducing PR.
- Pin pipx-installed zizmor to 1.24.1 (was unpinned 'pipx install
  zizmor' resolving to latest at run time).

Removes the now-stale residual-findings doc since every item it
recorded is resolved on this branch.

* fix(ci-security): clear remaining zizmor findings

After landing the new security workflows, zizmor reported 5 high+
findings against pre-existing workflows (none introduced by this PR's
new files, all introduced by zizmor's wider scope). Resolved per
research at docs.zizmor.sh and PyO3/maturin issue #2425:

Real fixes (cache-poisoning):
- publish.yml + release-candidate.yml: add 'package-manager-cache:
  false' to actions/setup-node. setup-node v5+ enables caching by
  default when a packageManager field is present in package.json;
  explicit opt-out keeps release installs hermetic and clears the
  audit. Cost: ~30s slower per release run.

Documented exemptions (dangerous-triggers, .github/zizmor.yml):
- ci-report.yml: workflow_run is REQUIRED to post sticky comments
  on fork PRs (forks have read-only GITHUB_TOKEN on pull_request).
- claude.yml: pull_request_target is required by claude-code-action
  to access secrets and post fork-PR review comments. PR checkouts
  pin fork HEAD SHA to mitigate TOCTOU.
- pr-labeler.yml: pull_request_target on the autolabel job needs
  pull-requests:write. release-drafter runs with dry-run:true and
  reads config from the BASE ref only.

Each exemption carries the documented mitigation in zizmor.yml.
workflow-lint.yml now passes --config to both the SARIF and the
gate invocations.

Local 'zizmor --config .github/zizmor.yml --min-severity high .'
reports: No findings to report. Good job!

2026-05-04 08:21:53 +01:00

3.7 KiB

Raw Blame History

Security Policy

Supported Versions

GitNexus is developed on main. Security fixes are applied to the latest released minor on npm (gitnexus) and to the published Docker images (Dockerfile.cli, Dockerfile.web). Older minors are not back-patched.

Reporting a Vulnerability

Please do not open a public GitHub issue for security reports.

Use GitHub Private Vulnerability Reporting for this repository:

→ https://github.com/abhigyanpatwari/GitNexus/security/advisories/new

Please include:

A description of the issue and its potential impact
Steps to reproduce (a minimal repro repo or commit hash if possible)
The affected version(s) — npm view gitnexus version, image digest, or commit SHA
Any suggested mitigation

What to expect

Acknowledgement: best-effort within 5 business days, subject to maintainer capacity.
Triage: we will confirm whether the report is in scope, request clarifications if needed, and propose a fix timeline.
Disclosure: coordinated. We will agree on a disclosure date with you before publishing an advisory.

Scope

In scope:

The gitnexus CLI and MCP server (gitnexus/)
The gitnexus-web thin client (gitnexus-web/)
The gitnexus-shared types package (gitnexus-shared/)
The published Docker images (Dockerfile.cli, Dockerfile.web)
GitHub Actions workflows in .github/workflows/

Out of scope:

Vulnerabilities in third-party dependencies that we have no influence over (please report upstream; if a viable mitigation exists at the GitNexus layer, that's in scope).
Issues requiring physical access to a developer machine or a compromised local environment.
Theoretical attacks without a practical exploit against a default GitNexus deployment.

Recommended Hardening for Forks and Self-Hosted Deployments

If you fork GitNexus or self-host it, we recommend enabling the following in your repository's Settings → Code security and analysis:

Private vulnerability reporting — the channel described above.
Dependabot alerts — alerts on advisories affecting your dependencies.
Dependabot security updates — automated PRs for security patches (this repo's .github/dependabot.yml already covers version updates).
Secret scanning and Push protection — blocks pushes that introduce known secret patterns. Defense-in-depth on top of the in-CI Gitleaks scan documented below.
Code scanning — surfaces SARIF results from CodeQL, Trivy, Scorecard, and zizmor in one place.

Automated Scans Running in CI

This repository runs the following scans automatically. Findings appear under the repository's Security → Code scanning tab.

Scan	Tool	Trigger	Action on finding
Static analysis (JS/TS, Python)	CodeQL	PR, `main` push, weekly	Advisory (Security tab)
Dependency vulnerabilities (PR diff)	`dependency-review-action`	PR	Blocks PR at `high+` severity
Secret scanning	Gitleaks	PR, `main` push	Blocks PR on default rules
Supply-chain posture	OpenSSF Scorecard	Weekly, `main` push	Advisory (Security tab + public badge)
Workflow lint	zizmor	PR (touching `.github/**`)	Blocks PR at `high+` severity
Container image scan	Trivy	Weekly, `main` push	Advisory (Security tab)

Dependency version updates are managed separately by Dependabot — see .github/dependabot.yml.

3.7 KiB Raw Blame History