Add security scan file for vulnerability scans #1039

hsri-pf9 · 2025-10-23T15:04:11Z

What this PR does / why we need it

This PR contains the vulnerability scanning in the codebase. It will scan the vulnerabilities in the codebase in this PR you can see the the summary report. When this PR will be merged to main, it will scan the main branch raise a report in form of PR in the pull requests and also store the report as artifact. Then in next PR it will scan the code changes and will tell in the summary how many vulnerabilities are fixed and how many are added. Also show the details that which vulnerabilities are added and fixed respectively.

Which issue(s) this PR fixes

(optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged)

fixes #

Special notes for your reviewer

Also for the scan in a particular PR, it will compare with the artifact if it is present on main branch and on method in the summary it will show as artifact and if the artifact is not present then the comparison will happen with live scan first scanning the code before the commits from the base branch and then scan with the committed code and generate the comparison.

Testing done

please add testing details (logs, screenshots, etc.)

.github/workflows/security.yml

+    name: Shared Setup
+    runs-on: ubuntu-latest
+    outputs:
+      go-version: '1.22'
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+      - name: Export Go Version
+        run: echo "go-version=1.22" >> $GITHUB_OUTPUT
+
+  gosec_scan:


To fix the problem, explicitly limit the permissions of the GITHUB_TOKEN for the setup job by adding a permissions block. Since the job only checks out code and sets outputs (with no repository writes or PR interaction), setting its permissions to contents: read is sufficient and adheres to least privilege.

Edit Details:

File: .github/workflows/security.yml

Region: Job definition starting at line 12 (setup:)

Insert permissions: block directly under line 13 (after name: Shared Setup)

Set permissions as follows:
permissions: contents: read

No new imports or methods needed. Only this change to the YAML block.

.github/workflows/security.yml

+    name: Vulnerability Summary Report
+    needs: [gosec_scan, trivy_scan]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request' && always()
+    steps:
+      - name: Create Vulnerability Summary Comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const gosecCurrent = '${{ needs.gosec_scan.outputs.gosec_current_count }}' || '0';
+            const gosecBaseline = '${{ needs.gosec_scan.outputs.gosec_baseline_count }}' || '0';
+            const gosecAdded = '${{ needs.gosec_scan.outputs.gosec_added_count }}' || '0';
+            const gosecFixed = '${{ needs.gosec_scan.outputs.gosec_fixed_count }}' || '0';
+
+            const trivyCurrent = '${{ needs.trivy_scan.outputs.trivy_current_count }}' || '0';
+            const trivyBaseline = '${{ needs.trivy_scan.outputs.trivy_baseline_count }}' || '0';
+            const trivyAdded = '${{ needs.trivy_scan.outputs.trivy_added_count }}' || '0';
+            const trivyFixed = '${{ needs.trivy_scan.outputs.trivy_fixed_count }}' || '0';
+
+            const trivyImageCurrent = '${{ needs.trivy_scan.outputs.trivy_image_current_count }}' || '0';
+            const trivyImageBaseline = '${{ needs.trivy_scan.outputs.trivy_image_baseline_count }}' || '0';
+            const trivyImageAdded = '${{ needs.trivy_scan.outputs.trivy_image_added_count }}' || '0';
+            const trivyImageFixed = '${{ needs.trivy_scan.outputs.trivy_image_fixed_count }}' || '0';
+
+            const gosecMethod = '${{ needs.gosec_scan.outputs.gosec_baseline_method }}' || 'none';
+            const trivyMethod = '${{ needs.trivy_scan.outputs.trivy_baseline_method }}' || 'none';
+            const trivyImageMethod = '${{ needs.trivy_scan.outputs.trivy_image_baseline_method }}' || 'none';
+
+            // Get detailed vulnerability information (safely encoded)
+            const gosecAddedDetails = ${{ toJSON(needs.gosec_scan.outputs.gosec_added_details) }} || '';
+            const gosecFixedDetails = ${{ toJSON(needs.gosec_scan.outputs.gosec_fixed_details) }} || '';
+            const trivyAddedDetails = ${{ toJSON(needs.trivy_scan.outputs.trivy_added_details) }} || '';
+            const trivyFixedDetails = ${{ toJSON(needs.trivy_scan.outputs.trivy_fixed_details) }} || '';
+            const trivyImageAddedDetails = ${{ toJSON(needs.trivy_scan.outputs.trivy_image_added_details) }} || '';
+            const trivyImageFixedDetails = ${{ toJSON(needs.trivy_scan.outputs.trivy_image_fixed_details) }} || '';
+
+            const totalAdded = parseInt(gosecAdded) + parseInt(trivyAdded) + parseInt(trivyImageAdded);
+            const totalFixed = parseInt(gosecFixed) + parseInt(trivyFixed) + parseInt(trivyImageFixed);
+            const totalCurrent = parseInt(gosecCurrent) + parseInt(trivyCurrent) + parseInt(trivyImageCurrent);
+            const totalBaseline = parseInt(gosecBaseline) + parseInt(trivyBaseline) + parseInt(trivyImageBaseline);
+
+            // Method indicators
+            const getMethodIcon = (method) => {
+              switch(method) {
+                case 'artifact': return '📦';
+                case 'live_scan': return '🔄';
+                case 'no_baseline': return '⚠️';
+                default: return '❓';
+              }
+            };
+
+            let statusIcon = '✅';
+            let statusText = 'No change in security posture';
+
+            if (totalAdded > 0 && totalFixed === 0) {
+              statusIcon = '🚨';
+              statusText = 'Security posture degraded';
+            } else if (totalAdded === 0 && totalFixed > 0) {
+              statusIcon = '🎉';
+              statusText = 'Security posture improved';
+            } else if (totalAdded > 0 && totalFixed > 0) {
+              statusIcon = '⚠️';
+              statusText = 'Mixed security changes';
+            }
+
+            const comment = `## ${statusIcon} Security Vulnerability Summary
+
+            **${statusText}**
+
+            ### 📊 Overall Changes
+            | Metric | Count |
+            |--------|-------|
+            | **Total Added** | **${totalAdded}** |
+            | **Total Fixed** | **${totalFixed}** |
+            | **Net Change** | **${totalAdded - totalFixed > 0 ? '+' : ''}${totalAdded - totalFixed}** |
+
+            ### 🔍 Detailed Breakdown
+
+            #### ${getMethodIcon(gosecMethod)} Gosec (Static Analysis)
+            | Current | Baseline | Added | Fixed | Method |
+            |---------|----------|-------|-------|--------|
+            | ${gosecCurrent} | ${gosecBaseline} | ${gosecAdded} | ${gosecFixed} | ${gosecMethod} |
+
+            #### ${getMethodIcon(trivyMethod)} Trivy (Dependency Scan)
+            | Current | Baseline | Added | Fixed | Method |
+            |---------|----------|-------|-------|--------|
+            | ${trivyCurrent} | ${trivyBaseline} | ${trivyAdded} | ${trivyFixed} | ${trivyMethod} |
+
+            #### ${getMethodIcon(trivyImageMethod)} Trivy (Docker Images)
+            | Current | Baseline | Added | Fixed | Method |
+            |---------|----------|-------|-------|--------|
+            | ${trivyImageCurrent} | ${trivyImageBaseline} | ${trivyImageAdded} | ${trivyImageFixed} | ${trivyImageMethod} |
+
+            ### 📋 Baseline Methods
+            - **📦 artifact**: Used stored report from main branch
+            - **🔄 live_scan**: Scanned base branch in real-time  
+            - **⚠️ no_baseline**: No baseline available (all vulnerabilities treated as new)
+
+            ${totalAdded > 0 ? `
+            ### 🚨 Added Vulnerabilities
+
+            ${parseInt(gosecAdded) > 0 ? `
+            #### Gosec (Static Analysis) - ${gosecAdded} Added
+            ${gosecAddedDetails || '*No detailed information available*'}
+            ` : ''}
+
+            ${parseInt(trivyAdded) > 0 ? `
+            #### Trivy (Dependencies) - ${trivyAdded} Added
+            ${trivyAddedDetails || '*No detailed information available*'}
+            ` : ''}
+
+            ${parseInt(trivyImageAdded) > 0 ? `
+            #### Trivy (Docker Images) - ${trivyImageAdded} Added
+            ${trivyImageAddedDetails || '*No detailed information available*'}
+            ` : ''}
+            ` : ''}
+
+            ${totalFixed > 0 ? `
+            ### 🎉 Fixed Vulnerabilities
+
+            ${parseInt(gosecFixed) > 0 ? `
+            #### Gosec (Static Analysis) - ${gosecFixed} Fixed
+            ${gosecFixedDetails || '*No detailed information available*'}
+            ` : ''}
+
+            ${parseInt(trivyFixed) > 0 ? `
+            #### Trivy (Dependencies) - ${trivyFixed} Fixed
+            ${trivyFixedDetails || '*No detailed information available*'}
+            ` : ''}
+
+            ${parseInt(trivyImageFixed) > 0 ? `
+            #### Trivy (Docker Images) - ${trivyImageFixed} Fixed
+            ${trivyImageFixedDetails || '*No detailed information available*'}
+            ` : ''}
+            ` : ''}
+
+            ---
+            *Only HIGH and CRITICAL severity vulnerabilities are tracked*
+            *Baseline: \`${{ github.event.pull_request.base.sha }}\`*`;
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: comment
+            });


To fix the problem, add a permissions block to the vulnerability_summary job in .github/workflows/security.yml, just beneath the runs-on: ubuntu-latest and above the steps: key. This block should grant only the minimal permissions necessary for the steps performed by the job. In this case, the only relevant step is posting a comment to a PR via the actions/github-script, so contents: read and pull-requests: write would be appropriate minimal permissions (alternatively, if Issue comments might be used, include issues: write). No imports or further code changes are needed.

github-actions · 2025-10-23T15:06:44Z

✅ Security Vulnerability Summary

No change in security posture

📊 Overall Changes

Metric	Count
Total Added	0
Total Fixed	0
Net Change	0

🔍 Detailed Breakdown

🔄 Gosec (Static Analysis)

Current	Baseline	Added	Fixed	Method
14	14	0	0	live_scan

🔄 Trivy (Dependency Scan)

Current	Baseline	Added	Fixed	Method
2	2	0	0	live_scan

⚠️ Trivy (Docker Images)

Current	Baseline	Added	Fixed	Method
0	0	0	0	no_baseline

📋 Baseline Methods

📦 artifact: Used stored report from main branch
🔄 live_scan: Scanned base branch in real-time
⚠️ no_baseline: No baseline available (all vulnerabilities treated as new)

Only HIGH and CRITICAL severity vulnerabilities are tracked
Baseline: 11b1ee2b7620455795b3370cd3cbe2f25881796e

github-actions · 2025-10-27T12:45:38Z

✅ Security Vulnerability Summary

No change in security posture

📊 Overall Changes

Metric	Count
Total Added	0
Total Fixed	0
Net Change	0

🔍 Detailed Breakdown

🔄 Gosec (Static Analysis)

Current	Baseline	Added	Fixed	Method
14	14	0	0	live_scan

🔄 Trivy (Dependency Scan)

Current	Baseline	Added	Fixed	Method
2	2	0	0	live_scan

📋 Baseline Methods

📦 artifact: Used stored report from main branch
🔄 live_scan: Scanned base branch in real-time
⚠️ no_baseline: No baseline available (all vulnerabilities treated as new)

Only HIGH and CRITICAL severity vulnerabilities are tracked
Baseline: 11b1ee2b7620455795b3370cd3cbe2f25881796e

github-actions · 2025-10-27T12:48:46Z

✅ Security Vulnerability Summary

No change in security posture

📊 Overall Changes

Metric	Count
Total Added	0
Total Fixed	0
Net Change	0

🔍 Detailed Breakdown

🔄 Gosec (Static Analysis)

Current	Baseline	Added	Fixed	Method
14	14	0	0	live_scan

🔄 Trivy (Dependency Scan)

Current	Baseline	Added	Fixed	Method
2	2	0	0	live_scan

📋 Baseline Methods

📦 artifact: Used stored report from main branch
🔄 live_scan: Scanned base branch in real-time
⚠️ no_baseline: No baseline available (all vulnerabilities treated as new)

Only HIGH and CRITICAL severity vulnerabilities are tracked
Baseline: 472113f1e8f81983cd7eb678547a47fc262abd3b

hsri-pf9 · 2025-10-27T13:21:12Z

go through the last summary report. The summary will be like this.

windsurf-bot

💡 To request another review, post a new comment with "/windsurf-review".

windsurf-bot · 2025-10-27T13:22:06Z

.github/workflows/security.yml

+      go-version: '1.22'
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+      - name: Export Go Version
+        run: echo "go-version=1.22" >> $GITHUB_OUTPUT


The Go version is hardcoded in both the output and the echo command. This creates a maintenance issue if the version needs to be updated. Consider using a single variable:

Suggested change

go-version: '1.22'

steps:

- name: Checkout Code

uses: actions/checkout@v4

- name: Export Go Version

run: echo "go-version=1.22" >> $GITHUB_OUTPUT

go-version: ${{ vars.GO_VERSION || '1.22' }}

steps:

- name: Checkout Code

uses: actions/checkout@v4

- name: Export Go Version

run: echo "go-version=${{ vars.GO_VERSION || '1.22' }}" >> $GITHUB_OUTPUT

windsurf-bot · 2025-10-27T13:22:06Z

.github/workflows/security.yml

+    branches:
+      - main
+      - harsh/soc2


The workflow is configured to run on a specific developer branch 'harsh/soc2'. For security workflows, it's better to limit triggers to main branches and PRs to avoid unnecessary runs and potential security information leakage. Consider removing this specific branch from the triggers.

windsurf-bot · 2025-10-27T13:22:06Z

.github/workflows/security.yml

+
+      - name: Create Pull Request (if vulnerabilities found)
+        if: ${{ github.event_name == 'push' && steps.scan.outputs.gosec_high_found == 'true' }}
+        continue-on-error: true


The 'Create Pull Request' steps for both Gosec and Trivy use 'continue-on-error: true', which means failures in creating security vulnerability reports will be silently ignored. For critical security operations, consider removing this option or adding explicit error handling to ensure security issues are properly reported.

github-actions · 2025-10-27T13:25:52Z

✅ Security Vulnerability Summary

No change in security posture

📊 Overall Changes

Metric	Count
Total Added	0
Total Fixed	0
Net Change	0

🔍 Detailed Breakdown

🔄 Gosec (Static Analysis)

Current	Baseline	Added	Fixed	Method
14	14	0	0	live_scan

🔄 Trivy (Dependency Scan)

Current	Baseline	Added	Fixed	Method
2	2	0	0	live_scan

📋 Baseline Methods

📦 artifact: Used stored report from main branch
🔄 live_scan: Scanned base branch in real-time
⚠️ no_baseline: No baseline available (all vulnerabilities treated as new)

Only HIGH and CRITICAL severity vulnerabilities are tracked
Baseline: 472113f1e8f81983cd7eb678547a47fc262abd3b

github-advanced-security bot found potential problems Oct 23, 2025

View reviewed changes

hsri-pf9 added 2 commits October 27, 2025 18:15

added security.yml file

a3fb6e6

removed image scan, gosec and trivy scan codebase

ec68bf6

hsri-pf9 force-pushed the private/main/harsh/soc2 branch from bf6ece6 to ec68bf6 Compare October 27, 2025 12:46

hsri-pf9 requested review from OmkarDeshpande7, sarika-pf9, sharma-tapas and spai-p9 October 27, 2025 13:19

hsri-pf9 marked this pull request as ready for review October 27, 2025 13:21

windsurf-bot bot reviewed Oct 27, 2025

View reviewed changes

removed harsh/soc2 branch from workflow file

290a6f1

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add security scan file for vulnerability scans #1039

Add security scan file for vulnerability scans #1039

Uh oh!

hsri-pf9 commented Oct 23, 2025 •

edited by huly-for-github bot

Loading

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

github-actions bot commented Oct 23, 2025

Uh oh!

github-actions bot commented Oct 27, 2025

Uh oh!

github-actions bot commented Oct 27, 2025

Uh oh!

hsri-pf9 commented Oct 27, 2025

Uh oh!

windsurf-bot bot left a comment

Uh oh!

windsurf-bot bot Oct 27, 2025

Uh oh!

windsurf-bot bot Oct 27, 2025

Uh oh!

windsurf-bot bot Oct 27, 2025

Uh oh!

github-actions bot commented Oct 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Add security scan file for vulnerability scans #1039

Are you sure you want to change the base?

Add security scan file for vulnerability scans #1039

Uh oh!

Conversation

hsri-pf9 commented Oct 23, 2025 • edited by huly-for-github bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it

Which issue(s) this PR fixes

Special notes for your reviewer

Testing done

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

github-actions bot commented Oct 23, 2025

✅ Security Vulnerability Summary

📊 Overall Changes

🔍 Detailed Breakdown

🔄 Gosec (Static Analysis)

🔄 Trivy (Dependency Scan)

⚠️ Trivy (Docker Images)

📋 Baseline Methods

Uh oh!

github-actions bot commented Oct 27, 2025

✅ Security Vulnerability Summary

📊 Overall Changes

🔍 Detailed Breakdown

🔄 Gosec (Static Analysis)

🔄 Trivy (Dependency Scan)

📋 Baseline Methods

Uh oh!

github-actions bot commented Oct 27, 2025

✅ Security Vulnerability Summary

📊 Overall Changes

🔍 Detailed Breakdown

🔄 Gosec (Static Analysis)

🔄 Trivy (Dependency Scan)

📋 Baseline Methods

Uh oh!

hsri-pf9 commented Oct 27, 2025

Uh oh!

windsurf-bot bot left a comment

Choose a reason for hiding this comment

Uh oh!

windsurf-bot bot Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

windsurf-bot bot Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

windsurf-bot bot Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Oct 27, 2025

✅ Security Vulnerability Summary

📊 Overall Changes

🔍 Detailed Breakdown

🔄 Gosec (Static Analysis)

🔄 Trivy (Dependency Scan)

📋 Baseline Methods

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hsri-pf9 commented Oct 23, 2025 •

edited by huly-for-github bot

Loading