From e2d09c0d52b29e6caacef63f839fad93591299f7 Mon Sep 17 00:00:00 2001 From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com> Date: Sun, 12 Jul 2026 23:48:09 +0200 Subject: [PATCH] fix(security): point OSV-Scanner at runnable subpath action; doc accuracy fixes - OSV-Scanner ref was google/osv-scanner-action@ (metadata-only root action, no runs:) -> subpath google/osv-scanner-action/osv-scanner-action which carries the docker action + scan-args input. Root ref would fail to load and redden the job on every run (caught in final whole-branch review). - security-scanning.md: note gitleaks findings land in job log (not SARIF); add scorecard branch_protection_rule trigger; mark SBOM/provenance as not- yet-live. CLAUDE.md row: image scan is a later plan, not current. --- .github/workflows/security.yml | 2 +- CLAUDE.md | 2 +- docs/systems/security-scanning.md | 10 +++++++--- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index e2479078..a19d95e4 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -51,7 +51,7 @@ jobs: - name: Checkout uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Run OSV-Scanner - uses: google/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 + uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 continue-on-error: true # report-only; enforcement flipped on in Plan E with: scan-args: |- diff --git a/CLAUDE.md b/CLAUDE.md index cce3a36d..76fca0e7 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -160,7 +160,7 @@ Before modifying any subsystem, read its spec from `docs/systems/`. After making | [message-list.md](docs/systems/message-list.md) | Auto-scroll model, position memory (session-only), embed renderer dimension contract, known limitations | Touching MessageList.tsx, scroll behavior, embed renderers, position restore | | [deployment.md](docs/systems/deployment.md) | Hosting pipeline: Docker/Caddy build, admin bootstrap, DB backup/restore, image pinning, env vars | Any deploy, backup/restore, or hosting change | | [activity-presence.md](docs/systems/activity-presence.md) | Presence states, rich activities, activity types/priorities, broadcast pipeline, visibility control, ActivityCard/Panel | Presence, rich activities, activity display, status management | -| [security-scanning.md](docs/systems/security-scanning.md) | CI security pipeline: Dependabot, CodeQL SAST, gitleaks, OSV-Scanner, Trivy (config/image/license), OpenSSF Scorecard, SHA-pinning, harden-runner, tiered enforcement policy, maintainer settings checklist | Any CI security work, adding/changing scanners, enabling enforcement, supply-chain hardening | +| [security-scanning.md](docs/systems/security-scanning.md) | CI security pipeline: Dependabot, CodeQL SAST, gitleaks, OSV-Scanner, Trivy (config/license; image scan in a later plan), OpenSSF Scorecard, SHA-pinning, harden-runner, tiered enforcement policy, maintainer settings checklist | Any CI security work, adding/changing scanners, enabling enforcement, supply-chain hardening | --- diff --git a/docs/systems/security-scanning.md b/docs/systems/security-scanning.md index 9504e355..104bdb31 100644 --- a/docs/systems/security-scanning.md +++ b/docs/systems/security-scanning.md @@ -13,7 +13,11 @@ later change once the remediation pass has cleared the backlog. | `.github/dependabot.yml` | Dependency + action + base-image update PRs | weekly | PRs | | `.github/workflows/codeql.yml` | CodeQL SAST (`javascript-typescript`, build-mode none) | PR + push main + weekly | Security tab | | `.github/workflows/security.yml` | gitleaks (secrets, full history), OSV-Scanner (deps), Trivy config (IaC), Trivy license | PR + push main + weekly | Security tab | -| `.github/workflows/scorecard.yml` | OpenSSF Scorecard (repo posture) | push main + weekly | Security tab + public badge | +| `.github/workflows/scorecard.yml` | OpenSSF Scorecard (repo posture) | push main + weekly + on branch-protection change | Security tab + public badge | + +> **gitleaks findings** surface in the workflow's job log and PR summary — the +> `gitleaks` job does not upload SARIF, so secret hits do **not** appear under +> Security → Code scanning (unlike the OSV / Trivy / CodeQL / Scorecard jobs). ## Tiered policy (target, enforced in a later change) @@ -32,8 +36,8 @@ merge-blocking, Dependabot alerts, and native secret-scanning are GitHub *settin tag-move attacks and satisfies Scorecard's Pinned-Dependencies check. - `step-security/harden-runner` (egress-policy `audit`) on Linux jobs. - Least-privilege `permissions:` per workflow/job. -- SBOM + SLSA provenance are attached to the published container image (added with - the image-scan work). +- SBOM + SLSA provenance **will be** attached to the published container image + (added with the container-image-scan work in a later plan — not yet live). ## Maintainer checklist (one-time GitHub settings — NOT code)