feat(security): add reusable fail-closed scans and mitigations #7

Merged

gitchegumi merged 1 commit from feat/security-pipelines into main

2026-09-04 12:55:13 -05:00

kiyi commented

2026-09-03 22:38:25 -05:00

Member

Exact expiring mitigations allow reviewed CVE/IaC/SAST findings, including UNKNOWN severity, while secrets, malware and scanner errors remain blocking. Documents cover reuse, runner requirements and policy updates. This is the foundation for the separate delivery PR.

Validation: real clean-source gate passed; a removed synthetic secret was detected in Git history and redacted from the decision; a downloaded image archive completed Trivy/ClamAV/SBOM checks and correctly failed its blocking findings. Policy/malware unit checks and YAML/Bash/exit-code checks passed. No app image or UDS bundle was built, and nothing was deployed.

Refs #1, #3, #4. Configure SCAN_RUNNER and run the included acceptance workflow on Forgejo after review; live cross-repo activation remains to be confirmed. Runner migration #2 stays deferred.

Add a reusable security gate for personal and organization repositories: Gitleaks history/tree scanning, Trivy dependency/IaC/image scans and SBOMs, Semgrep SAST, and ClamAV malware scanning with current official signatures. Tools and Python dependencies are checksum/hash pinned; uploaded reports omit secret values and raw snippets. Exact expiring mitigations allow reviewed CVE/IaC/SAST findings, including UNKNOWN severity, while secrets, malware and scanner errors remain blocking. Documents cover reuse, runner requirements and policy updates. This is the foundation for the separate delivery PR. Validation: real clean-source gate passed; a removed synthetic secret was detected in Git history and redacted from the decision; a downloaded image archive completed Trivy/ClamAV/SBOM checks and correctly failed its blocking findings. Policy/malware unit checks and YAML/Bash/exit-code checks passed. No app image or UDS bundle was built, and nothing was deployed. Refs #1, #3, #4. Configure SCAN_RUNNER and run the included acceptance workflow on Forgejo after review; live cross-repo activation remains to be confirmed. Runner migration #2 stays deferred.

kiyi added 1 commit

2026-09-03 22:38:25 -05:00

feat(security): add reusable fail-closed scans and mitigations

Library checks / tests (pull_request) Has been cancelled

Details

cd42a854e9

Run verified Gitleaks, Trivy, Semgrep and ClamAV with sanitized artifacts and exact expiring mitigations. Add source and image checks, hashed tool installation, and real scanner acceptance fixtures.

kiyi referenced this pull request

2026-09-03 22:44:46 -05:00

feat(delivery): scan and sign containers and UDS releases #8

kiyi referenced this pull request

2026-09-03 22:50:31 -05:00

Implement build-once artifact publishing and controlled promotion #5

kiyi referenced this pull request

2026-09-03 22:50:54 -05:00

Implement the standard security scan baseline #4