bf147d6adeac7e8fbdece323116a1266754d6504
1 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Anthony Ettinger
|
544d740ab0 |
ci: scan pull requests for credentials and injection with ThreatCrush (#3427)
Adds a pull-request workflow that scans the diff for hardcoded credentials, injection, SSRF and unsafe deserialisation. Results go to the Security tab as SARIF and to a comment on the pull request. ### What it does on this repository ``` @profullstack/threatcrush@0.11.0 scan . 6908 files in 27.5s — 4570 finding(s): 38 high, 4061 medium, 471 low confidence: 500 evidence, 4070 pattern ``` **None of that is a claim about your code, and I have not verified any of it.** `confidence: pattern` means a regex matched and nothing more; expect false positives in that tier. It is here because the check on this pull request may never run at all — GitHub withholds workflow runs from first-time contributors, and across 24 open requests elsewhere not one has been approved. Rather than ask you to approve a run to find out what it produces, that is what it produces. Opened alongside the question in https://github.com/Runfusion/Fusion/issues/3426, which is the place to say no or ask for changes. This is only the diff, so it is there to read rather than imagine — closing either one is a fine answer. **This is not a CodeQL replacement, and it is worth saying where it differs.** CodeQL does semantic dataflow analysis and is better at it than this is — a repository already running it is not missing much by closing this. Two gaps it does fill: - Code scanning and secret scanning are free on public repositories, but need paid GitHub Code Security / Secret Protection on private ones. This is MIT and free on both, so the same gate can run across a mixed set of repositories. - CodeQL analyses a fixed set of languages, and among compiled ones it analyses only the language with the most source files unless it's explicitly configured otherwise. In a polyglot repository the rest goes unscanned by default; this reads every file it is pointed at. It is additive and report-only, so running both costs a few CI minutes and changes nothing else. **It is report-only.** `failOn` is empty, so it annotates and never fails a build. A repository with pre-existing findings should get a report on its first install, not a blocked pull request — a gate that fires on everything gets switched off within a day. Tighten it to `critical,high` in the workflow once any backlog is triaged. - `.github/workflows/threatcrush-scan.yml` — the workflow - `.github/scripts/threatcrush-to-sarif.py` — a compatibility shim for CLI versions older than native SARIF output; unused once the installed CLI can emit it itself Permissions are least-privilege (`contents: read`, `pull-requests: write`, `security-events: write`). It runs on `pull_request`, not `pull_request_target`, so contributor code never executes with your secrets in scope. The SARIF upload is `continue-on-error` and degrades quietly where code scanning is unavailable. The CLI is pinned to `@profullstack/threatcrush@0.11.0` and installed with `--ignore-scripts`, and checkout runs with `persist-credentials: false`. A scanner that installs a floating version, runs its dependencies' lifecycle scripts and leaves a token in `.git/config` is asking you to trust more than it is worth, and none of that is needed to read a diff. Bump the pin whenever you like — nothing here updates itself. Disclosure: I maintain [ThreatCrush](https://github.com/profullstack/threatcrush). It is free and MIT, and the workflow installs it from npm — nothing here phones home. If this is not something you want, closing it is the right answer, and I will not send another. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added automated ThreatCrush security scanning for pull requests. * Scan results are converted to a standardized format and uploaded for review. * Findings can update pull request comments and generate downloadable reports and artifacts. * Supports current and legacy scanner output formats. * Adds configurable severity thresholds and verified scanner installation. * **Bug Fixes** * Invalid, incomplete, or unrecognized scan output now fails safely with clear diagnostics. * Scan failures and security findings are reliably reported. * Improved handling of scan completion status and finding details. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Anthony Ettinger <anthony@chovy.com> Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com> |