Adds a pull-request workflow that scans the diff for hardcoded
credentials,
injection, SSRF and unsafe deserialisation. Results go to the Security
tab as
SARIF and to a comment on the pull request.
### What it does on this repository
```
@profullstack/threatcrush@0.11.0 scan .
6908 files in 27.5s — 4570 finding(s): 38 high, 4061 medium, 471 low
confidence: 500 evidence, 4070 pattern
```
**None of that is a claim about your code, and I have not verified any
of it.**
`confidence: pattern` means a regex matched and nothing more; expect
false
positives in that tier. It is here because the check on this pull
request may
never run at all — GitHub withholds workflow runs from first-time
contributors,
and across 24 open requests elsewhere not one has been approved. Rather
than ask
you to approve a run to find out what it produces, that is what it
produces.
Opened alongside the question in
https://github.com/Runfusion/Fusion/issues/3426, which is the place to
say no or ask for
changes. This is only the diff, so it is there to read rather than
imagine —
closing either one is a fine answer.
**This is not a CodeQL replacement, and it is worth saying where it
differs.**
CodeQL does semantic dataflow analysis and is better at it than this is
— a
repository already running it is not missing much by closing this. Two
gaps it
does fill:
- Code scanning and secret scanning are free on public repositories, but
need
paid GitHub Code Security / Secret Protection on private ones. This is
MIT and
free on both, so the same gate can run across a mixed set of
repositories.
- CodeQL analyses a fixed set of languages, and among compiled ones it
analyses
only the language with the most source files unless it's explicitly
configured
otherwise. In a polyglot repository the rest goes unscanned by default;
this
reads every file it is pointed at.
It is additive and report-only, so running both costs a few CI minutes
and
changes nothing else.
**It is report-only.** `failOn` is empty, so it annotates and never
fails a build.
A repository with pre-existing findings should get a report on its first
install,
not a blocked pull request — a gate that fires on everything gets
switched off
within a day. Tighten it to `critical,high` in the workflow once any
backlog is
triaged.
- `.github/workflows/threatcrush-scan.yml` — the workflow
- `.github/scripts/threatcrush-to-sarif.py` — a compatibility shim for
CLI versions
older than native SARIF output; unused once the installed CLI can emit
it itself
Permissions are least-privilege (`contents: read`, `pull-requests:
write`,
`security-events: write`). It runs on `pull_request`, not
`pull_request_target`,
so contributor code never executes with your secrets in scope. The SARIF
upload
is `continue-on-error` and degrades quietly where code scanning is
unavailable.
The CLI is pinned to `@profullstack/threatcrush@0.11.0` and installed
with
`--ignore-scripts`, and checkout runs with `persist-credentials: false`.
A
scanner that installs a floating version, runs its dependencies'
lifecycle
scripts and leaves a token in `.git/config` is asking you to trust more
than it
is worth, and none of that is needed to read a diff. Bump the pin
whenever you
like — nothing here updates itself.
Disclosure: I maintain
[ThreatCrush](https://github.com/profullstack/threatcrush).
It is free and MIT, and the workflow installs it from npm — nothing here
phones
home. If this is not something you want, closing it is the right answer,
and I
will not send another.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated ThreatCrush security scanning for pull requests.
* Scan results are converted to a standardized format and uploaded for
review.
* Findings can update pull request comments and generate downloadable
reports and artifacts.
* Supports current and legacy scanner output formats.
* Adds configurable severity thresholds and verified scanner
installation.
* **Bug Fixes**
* Invalid, incomplete, or unrecognized scan output now fails safely with
clear diagnostics.
* Scan failures and security findings are reliably reported.
* Improved handling of scan completion status and finding details.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Signed-off-by: Anthony Ettinger <anthony@chovy.com>
Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>
544d740ab0