Implement the standard security scan baseline

kiyi commented

2026-09-03 21:30:21 -05:00

Member

Implement reusable open-source security checks alongside the Gitleaks work in #1. No paid scanning service or cloud account should be required.

Acceptance:

Gitleaks covers history and working tree with redacted findings (#1); Trivy covers dependency lockfiles, infrastructure misconfiguration and immutable container images; Semgrep CE covers owned application source with a reviewed local rule pack.
Scanner versions and action commits are pinned in a reviewed runner/toolchain release; updates are tracked.
Block detected secrets and HIGH/CRITICAL dependency, image and IaC findings by default; SAST rules define a reviewed blocking baseline. Exceptions have a reason, owner, scope and expiry. Do not globally ignore unfixed vulnerabilities.
Render Helm/Kustomize before IaC scans; add ShellCheck and Kubernetes schema validation where applicable. Document unsupported languages and scan exclusions.
Generate CycloneDX SBOMs and retain access-controlled/redacted reports tied to source SHA and image digest; confirm Forgejo artifact compatibility and retention.
Positive, negative and scanner-error fixtures prove gates fail correctly; scans also run on a schedule to catch newly disclosed vulnerabilities.
Protect workflow/policy changes and require stable status checks after successful runner validation.

Depends on reusable workflow/runner activation in #3. Start with scan-only CI; publishing/signing/deployment credentials must not reach PR scan jobs. Initial scaffold does not prove the scanner suite has run.

Implement reusable open-source security checks alongside the Gitleaks work in #1. No paid scanning service or cloud account should be required. Acceptance: - [x] Gitleaks covers history and working tree with redacted findings (#1); Trivy covers dependency lockfiles, infrastructure misconfiguration and immutable container images; Semgrep CE covers owned application source with a reviewed local rule pack. - [x] Scanner versions and action commits are pinned in a reviewed runner/toolchain release; updates are tracked. - [x] Block detected secrets and HIGH/CRITICAL dependency, image and IaC findings by default; SAST rules define a reviewed blocking baseline. Exceptions have a reason, owner, scope and expiry. Do not globally ignore unfixed vulnerabilities. - [x] Render Helm/Kustomize before IaC scans; add ShellCheck and Kubernetes schema validation where applicable. Document unsupported languages and scan exclusions. - [x] Generate CycloneDX SBOMs and retain access-controlled/redacted reports tied to source SHA and image digest; confirm Forgejo artifact compatibility and retention. - [x] Positive, negative and scanner-error fixtures prove gates fail correctly; scans also run on a schedule to catch newly disclosed vulnerabilities. - [x] Protect workflow/policy changes and require stable status checks after successful runner validation. Depends on reusable workflow/runner activation in #3. Start with scan-only CI; publishing/signing/deployment credentials must not reach PR scan jobs. Initial scaffold does not prove the scanner suite has run.

kiyi added this to the Homelab Roadmap project

2026-09-03 21:30:21 -05:00

kiyi referenced this issue

2026-09-03 21:31:00 -05:00

Implement build-once artifact publishing and controlled promotion #5

kiyi referenced this issue

2026-09-03 21:40:01 -05:00

feat(ci): scaffold reusable security and delivery workflows #6

kiyi referenced this issue

2026-09-03 21:40:24 -05:00

Add secret scanning for commits and Forgejo Actions #1

kiyi referenced this issue

2026-09-03 22:38:25 -05:00

feat(security): add reusable fail-closed scans and mitigations #7

kiyi commented

2026-09-03 22:50:54 -05:00

Author

Member

PR #7 implements the reusable Gitleaks/Trivy/Semgrep/ClamAV gate, pinned toolchain, sanitized reports, CycloneDX SBOMs and exact expiring mitigations. PR #8 applies it to locally built image archives and every bundle image before publication/deployment. ClamAV updates its signed database and scans source plus flattened image filesystems; malware and scanner failures cannot be mitigated away.

Real tests covered clean source, a synthetic secret removed from Git history, report redaction, downloaded Alpine archives and offline signature tampering. The unit suite now has 25 passing cases. No real application was built or deployed.

Live runner/artifact compatibility, repository status protection and first app acceptance remain to be confirmed after merge. Current UDS delivery accepts concrete rendered manifests; it does not render arbitrary Helm/Kustomize inputs. Keep this issue open for the remaining acceptance checklist.

PR #7 implements the reusable Gitleaks/Trivy/Semgrep/ClamAV gate, pinned toolchain, sanitized reports, CycloneDX SBOMs and exact expiring mitigations. PR #8 applies it to locally built image archives and every bundle image before publication/deployment. ClamAV updates its signed database and scans source plus flattened image filesystems; malware and scanner failures cannot be mitigated away. Real tests covered clean source, a synthetic secret removed from Git history, report redaction, downloaded Alpine archives and offline signature tampering. The unit suite now has 25 passing cases. No real application was built or deployed. Live runner/artifact compatibility, repository status protection and first app acceptance remain to be confirmed after merge. Current UDS delivery accepts concrete rendered manifests; it does not render arbitrary Helm/Kustomize inputs. Keep this issue open for the remaining acceptance checklist.

kiyi commented

2026-09-04 13:00:12 -05:00

Author

Member

Checklist review: checked the implemented scanner coverage and blocking/mitigation policy. Evidence is in #7/#8, pipeline/security.py, pipeline/malware.py and docs/security.md. Real tests covered historical/working-tree secrets, sanitized reports, source scans and downloaded image archives; local unit tests reached 27 passing cases. Semgrep rules are fetched and checksum-verified into the job rather than redistributed in Git. ClamAV is included and malware/scanner failures cannot be waived.

Left the compound items unchecked where part remains: tool/action pins and update instructions exist, but reviewed toolchain release/ongoing update tracking are not yet demonstrated; Helm/Kustomize rendering, ShellCheck and Kubernetes schema validation are not implemented by the concrete-manifest profile; SBOM/report generation exists but live Forgejo artifact/retention acceptance remains; failure fixtures exist but scheduled scanning remains; stable required status checks and workflow/policy protection still need runner validation. These are specific remaining tasks, not a request to redo completed scanner work.

Checklist review: checked the implemented scanner coverage and blocking/mitigation policy. Evidence is in #7/#8, pipeline/security.py, pipeline/malware.py and docs/security.md. Real tests covered historical/working-tree secrets, sanitized reports, source scans and downloaded image archives; local unit tests reached 27 passing cases. Semgrep rules are fetched and checksum-verified into the job rather than redistributed in Git. ClamAV is included and malware/scanner failures cannot be waived. Left the compound items unchecked where part remains: tool/action pins and update instructions exist, but reviewed toolchain release/ongoing update tracking are not yet demonstrated; Helm/Kustomize rendering, ShellCheck and Kubernetes schema validation are not implemented by the concrete-manifest profile; SBOM/report generation exists but live Forgejo artifact/retention acceptance remains; failure fixtures exist but scheduled scanning remains; stable required status checks and workflow/policy protection still need runner validation. These are specific remaining tasks, not a request to redo completed scanner work.

kiyi referenced this issue

2026-09-04 16:35:31 -05:00

fix(ci): add trusted repository self-scan #12

kiyi commented

2026-09-04 16:36:42 -05:00

Author

Member

Checked two acceptance items now supported by reviewed and live evidence. The scanner/tool versions are pinned in the reviewed v1.1.0 release and the documented release protocol controls updates. Homelab/bundles runs 9 and 12 confirmed CycloneDX/security report generation and Forgejo artifact retention on the ci runner.

PR #12 adds scheduled scanning and protects this repository with the released gate. I am leaving the combined fixture/schedule item unchecked until that PR is merged and its self-scan completes. Rendering, ShellCheck/schema validation, and stable required-check protection remain the next substantive gaps.

Checked two acceptance items now supported by reviewed and live evidence. The scanner/tool versions are pinned in the reviewed v1.1.0 release and the documented release protocol controls updates. Homelab/bundles runs 9 and 12 confirmed CycloneDX/security report generation and Forgejo artifact retention on the ci runner. PR #12 adds scheduled scanning and protects this repository with the released gate. I am leaving the combined fixture/schedule item unchecked until that PR is merged and its self-scan completes. Rendering, ShellCheck/schema validation, and stable required-check protection remain the next substantive gaps.

kiyi referenced this issue

2026-09-04 16:36:54 -05:00

Implement build-once artifact publishing and controlled promotion #5

kiyi referenced this issue

2026-09-04 16:44:31 -05:00

fix(ci): add trusted repository self-scan #12

kiyi referenced this issue

2026-09-04 16:53:52 -05:00

feat(security): validate shell and Kubernetes sources #13

kiyi commented

2026-09-04 16:54:08 -05:00

Author

Member

PR #13 implements the remaining source-side validation work: ShellCheck runs on tracked shell scripts, callers can explicitly render local Helm charts and Kustomize overlays, Kubeconform validates built-in Kubernetes resources against a concrete schema version, and Trivy scans rendered manifests. Paths are constrained to the checkout, Helm does not download dependencies, and CRD validation limits are documented.

Local evidence: 35 unit/contract tests passed; YAML/Bash syntax and 16 mocked workflow cases passed; the exact checksum-pinned ShellCheck 0.10.0, Helm 4.2.0, Kustomize 5.8.1, and Kubeconform 0.7.0 binaries passed a real render-and-validate fixture. I am leaving the combined checklist item unchecked until the PR's runner check passes and the change is merged.

PR #13 implements the remaining source-side validation work: ShellCheck runs on tracked shell scripts, callers can explicitly render local Helm charts and Kustomize overlays, Kubeconform validates built-in Kubernetes resources against a concrete schema version, and Trivy scans rendered manifests. Paths are constrained to the checkout, Helm does not download dependencies, and CRD validation limits are documented. Local evidence: 35 unit/contract tests passed; YAML/Bash syntax and 16 mocked workflow cases passed; the exact checksum-pinned ShellCheck 0.10.0, Helm 4.2.0, Kustomize 5.8.1, and Kubeconform 0.7.0 binaries passed a real render-and-validate fixture. I am leaving the combined checklist item unchecked until the PR's runner check passes and the change is merged.

gitchegumi referenced this issue

2026-09-04 20:18:58 -05:00

chore(ci): adopt workflows v1.2.0 for repository scans #14

gitchegumi referenced this issue from a commit

2026-09-04 21:17:23 -05:00

chore(ci): adopt workflows v1.2.0 for repository scans

kiyi commented

2026-09-04 23:45:46 -05:00

Author

Member

Progress reconciled after the v1.2.1 release and adoption.

Rendering/ShellCheck/Kubernetes validation is merged in #13 and released; the main-branch checks passed. #15 fixes Trivy IaC fingerprints so each source occurrence has its own mitigation and missing location metadata fails closed. The release includes 41 passing unit/contract tests and 16 scaffold cases.
The scheduled self-scan from #12 is merged (weekly cron), and both PR and main-branch scans are working. Latest evidence: PR scan 59, main scan 61, and main library tests 62. This records schedule configuration and successful executions, not a separately observed scheduled trigger.
v1.2.1 adoption is merged in #16, Homelab/bundles#6 and Homelab/platform#21. Platform acceptance reported 0 blocking findings, 25 occurrence-specific mitigations and 0 scanner errors.
The owner confirmed main-branch protection and required status checks are configured. Required PR contexts: workflows Repository security / security-1 (pull_request) and Library checks / tests (pull_request); bundles and platform Source security / security (pull_request). Workflow/policy changes follow the protected-branch PR/review/check process. Per owner decision, protected-file patterns are intentionally omitted so reviewed workflow version updates can merge.

Checked the remaining baseline items against this evidence. The dedicated live synthetic-secret failure test remains tracked in #1; cross-namespace execution/credential isolation in #3 and first application delivery in #5 remain open.

Progress reconciled after the v1.2.1 release and adoption. - Rendering/ShellCheck/Kubernetes validation is merged in #13 and released; the main-branch checks passed. #15 fixes Trivy IaC fingerprints so each source occurrence has its own mitigation and missing location metadata fails closed. The release includes 41 passing unit/contract tests and 16 scaffold cases. - The scheduled self-scan from #12 is merged (weekly cron), and both PR and main-branch scans are working. Latest evidence: [PR scan 59](https://git.gitchegumi.com/Homelab/workflows/actions/runs/59), [main scan 61](https://git.gitchegumi.com/Homelab/workflows/actions/runs/61), and [main library tests 62](https://git.gitchegumi.com/Homelab/workflows/actions/runs/62). This records schedule configuration and successful executions, not a separately observed scheduled trigger. - v1.2.1 adoption is merged in #16, Homelab/bundles#6 and Homelab/platform#21. Platform acceptance reported 0 blocking findings, 25 occurrence-specific mitigations and 0 scanner errors. - The owner confirmed main-branch protection and required status checks are configured. Required PR contexts: workflows `Repository security / security-1 (pull_request)` and `Library checks / tests (pull_request)`; bundles and platform `Source security / security (pull_request)`. Workflow/policy changes follow the protected-branch PR/review/check process. Per owner decision, protected-file patterns are intentionally omitted so reviewed workflow version updates can merge. Checked the remaining baseline items against this evidence. The dedicated live synthetic-secret failure test remains tracked in #1; cross-namespace execution/credential isolation in #3 and first application delivery in #5 remain open.

kiyi referenced this issue

2026-09-04 23:46:55 -05:00

Implement build-once artifact publishing and controlled promotion #5