Skip to content

feat(cis-scans): add GH CIS scan action #303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
pankajmouriyakong wants to merge 14 commits into
base: main
Choose a base branch
from
Open

feat(cis-scans): add GH CIS scan action #303

pankajmouriyakong wants to merge 14 commits into from

Conversation

@pankajmouriyakong
Copy link
Contributor

@pankajmouriyakong pankajmouriyakong commented Sep 11, 2025 •
edited
Loading

Summary

Add composite action for GH CIS compliance scanning using Legitify with SARIF report generation and artifact upload.

Changes

  • New security-actions/cis-scans composite action
  • SARIF report generation and upload
  • Workflow file to test the action

@pankajmouriyakong pankajmouriyakong requested review from a team as code owners September 11, 2025 09:31
@github-actions
Copy link

github-actions bot commented Sep 11, 2025 •
edited
Loading

Luacheck Report

1 files  1 suites   0s ⏱️
4 tests 4 ✅ 0 💤 0 ❌
8 runs  8 ✅ 0 💤 0 ❌

Results for commit 55dc907.

♻️ This comment has been updated with latest results.

@pankajmouriyakong pankajmouriyakong added WIP Work is still in Progress Do-not-merge Do not merge the PR as it is not ready yet, it is WIP. labels Sep 11, 2025
@pankajmouriyakong pankajmouriyakong changed the title feat(scan-gh-cis): add GH CIS scan action WIP - feat(scan-gh-cis): add GH CIS scan action Sep 11, 2025
@github-advanced-security
Copy link

github-advanced-security bot commented Sep 18, 2025

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@saisatishkarra
Copy link
Contributor

saisatishkarra commented Sep 18, 2025

@pankajmouriyakong update on this one?

saisatishkarra
saisatishkarra reviewed Sep 18, 2025
View reviewed changes
saisatishkarra
saisatishkarra reviewed Sep 18, 2025
View reviewed changes
saisatishkarra
saisatishkarra suggested changes Sep 21, 2025
View reviewed changes
security-actions/cis-scans/package.json Outdated
@@ -0,0 +1,14 @@
{
"name": "cis-scans",
Copy link
Contributor

@saisatishkarra saisatishkarra Sep 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

May be audit-github-repository or similar to indicate purpose?

Copy link
Contributor Author

@pankajmouriyakong pankajmouriyakong Sep 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reason kept it cis-scans with the intention to add more future CIS scans to this action(say CIS kubernetes, move existing Docker CIS here). Making it "audit-github-repository" makes it specific to github audit. LMK what you think?

Copy link
Contributor Author

@pankajmouriyakong pankajmouriyakong Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed the action directory name to scan-gh-config

@saisatishkarra
Copy link
Contributor

saisatishkarra commented Sep 21, 2025

This woohld force someone to run all the checks in one go, when would this be thr case? Otherwise we need to add conditions.

If any complex logic needs to be added specific to control they all go in 1 file that makes it unmangeable rather be modular.

@pankajmouriyakong
Copy link
Contributor Author

pankajmouriyakong commented Sep 21, 2025

This woohld force someone to run all the checks in one go, when would this be thr case? Otherwise we need to add conditions.

If any complex logic needs to be added specific to control they all go in 1 file that makes it unmangeable rather be modular.

The idea was to adjust for better user UX here. Also Charly shared his 2c as an end user so(having to run less actions).
But I do see a point/challenge here with bundled CIS scans as their requirements will be different as well(for Docker CIS - image name, dockerfile path may be, with GH CIS - repo name and token with GH config access). I will update the action name and make it GH specific.

pankajmouriyakong and others added 11 commits September 22, 2025 18:47
@pankajmouriyakong
feat(scan-gh-config): add GH CIS scan action
ee3d112
@pankajmouriyakong
feat(ci): fix typo
5233807
@pankajmouriyakong
feat(scan-docker-image): add by-cve flag to organise results by CVE (#…
0384348 
…310)
@kong-security-bot @pankajmouriyakong
chore(release): publish [skip ci]
3f11fd3 
 - scan-docker-image@5.1.0
@pankajmouriyakong
feat(scan-gh-config): add legitify action
b7d9ac5
@pankajmouriyakong
feat(scan-gh-config): remove on PR event trigger from workflow file
5f5073e
@dependabot @pankajmouriyakong
github-actions(deps): bump github/codeql-action in /security-actions/…
c2c4179 
…sca (#302)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.7 to 3.30.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@51f7732...192325c)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.30.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Pankaj <pankaj.mouriya@konghq.com>
@kong-security-bot @pankajmouriyakong
chore(release): publish [skip ci]
b80b435 
 - sca@5.1.2
@pankajmouriyakong @dependabot
chore(deps): combine update dep versions (#312)
a7e0294 
* github-actions(deps): bump sigstore/cosign-installer

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.9.1 to 3.10.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@398d4b0...d7543c9)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 3.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* github-actions(deps): bump anchore/sbom-action

Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.20.5 to 0.20.6.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@da167ea...f8bdd1d)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-version: 0.20.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* github-actions(deps): bump anchore/scan-action

Bumps [anchore/scan-action](https://github.com/anchore/scan-action) from 6.5.1 to 7.0.0.
- [Release notes](https://github.com/anchore/scan-action/releases)
- [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md)
- [Commits](anchore/scan-action@1638637...f660128)

---
updated-dependencies:
- dependency-name: anchore/scan-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* github-actions(deps): bump anchore/scan-action in /security-actions/sca

Bumps [anchore/scan-action](https://github.com/anchore/scan-action) from 6.5.1 to 7.0.0.
- [Release notes](https://github.com/anchore/scan-action/releases)
- [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md)
- [Commits](anchore/scan-action@1638637...f660128)

---
updated-dependencies:
- dependency-name: anchore/scan-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* github-actions(deps): bump anchore/sbom-action in /security-actions/sca

Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.20.5 to 0.20.6.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@da167ea...f8bdd1d)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-version: 0.20.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@kong-security-bot @pankajmouriyakong
chore(release): publish [skip ci]
e51167d 
 - sca@5.1.3
 - scan-docker-image@5.1.1
 - sign-docker-image@5.0.3
@pankajmouriyakong
chore(scan-gh-config): rename action name
a5d1541
@pankajmouriyakong pankajmouriyakong force-pushed the feat/add-legitify-gh-cis-scan-action branch from 3680459 to a5d1541 Compare September 22, 2025 13:20
@pankajmouriyakong
Copy link
Contributor Author

pankajmouriyakong commented Sep 22, 2025

@saisatishkarra please review again and stamp it

saisatishkarra
saisatishkarra suggested changes Sep 23, 2025
View reviewed changes
security-actions/scan-gh-config/README.md
- name: Run CIS Compliance Scan
uses: Kong/public-shared-actions/security-actions/scan-gh-config@COMMIT-SHA
with:
github_token: ${{ secrets.CLASSIC_PAT }}
Copy link
Contributor

@saisatishkarra saisatishkarra Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why does this need classic PAT ?

  • This action is meant to run only in the repository it is configured.
  • Teams mostly use app token.
  • Update usage/example accordingly to reflect "As-Is" for CI

what permissions are required to scan only specific repository ?

Copy link
Contributor Author

@pankajmouriyakong pankajmouriyakong Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Legitify supports Classic PATs and their GH README explicitly mentions that they don't support fine grained PATs and there is no mention of GitHub App tokens yet.

Let me run a scan with GIthub App PAT token and with repo level permissions and get back on this and rest of the comments.

security-actions/scan-gh-config/README.md
uses: Kong/public-shared-actions/security-actions/scan-gh-config@COMMIT-SHA
with:
github_token: ${{ secrets.SECURITY_BOT_LEGITIFY_TOKEN }}
repositories: "${{github.repository_owner}}/httpsnippet"
Copy link
Contributor

@saisatishkarra saisatishkarra Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use {{github.repository}} to keep this generic

security-actions/scan-gh-config/README.md
- name: Run Legitify CIS Scan
uses: Kong/public-shared-actions/security-actions/scan-gh-config@COMMIT-SHA
with:
github_token: ${{ secrets.SECURITY_BOT_LEGITIFY_TOKEN }}
Copy link
Contributor

@saisatishkarra saisatishkarra Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Keep this token <secrets.GITHUB_TOKEN> - Either a PAT or App token based example

security-actions/scan-gh-config/README.md
The action generates multiple output formats:

### 2. GitHub Code Scanning Integration
- SARIF report automatically uploaded to Security tab
Copy link
Contributor

@saisatishkarra saisatishkarra Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For public repositories only. CodeQL is paid feature for other repo types.

security-actions/scan-gh-config/README.md
### 2. GitHub Code Scanning Integration
- SARIF report automatically uploaded to Security tab
- Findings appear alongside other code scanning results
- **Note**: Only works for public repositories and when `codeql_upload` is set to `true`
Copy link
Contributor

@saisatishkarra saisatishkarra Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Document reporting format for private repositories

security-actions/scan-gh-config/README.md

### Token Permissions
The GitHub token needs these scopes:
- `admin:org` - Organization management
Copy link
Contributor

@saisatishkarra saisatishkarra Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why Org:Admin ? Is repo:Admin scope not sufficieint when running a single repo ?

security-actions/scan-gh-config/README.md
### Token Permissions
The GitHub token needs these scopes:
- `admin:org` - Organization management
- `read:enterprise` - Enterprise settings
Copy link
Contributor

@saisatishkarra saisatishkarra Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should not be required. validate it please.

security-actions/scan-gh-config/action.yml
artifact_name:
description: 'Name for the artifact containing scan results'
required: false
default: 'legitify-cis-scan-results'
Copy link
Contributor

@saisatishkarra saisatishkarra Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Default doesn't match with legitify-output.* elsewhere in the code. What is the source of truth ?

security-actions/scan-gh-config/action.yml
if: ${{ steps.legitify-scan.conclusion == 'success' }}
shell: bash
run: |
if ls legitify-output.* 1> /dev/null 2>&1; then
Copy link
Contributor

@saisatishkarra saisatishkarra Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this a regex ? Isn't a single file produced when run on a repository ? If so, use -f <filename> to check existence

security-actions/scan-gh-config/action.yml
echo "::warning::No Legitify output files found"
fi

- name: Upload outputs as Workflow Artifacts
Copy link
Contributor

@saisatishkarra saisatishkarra Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this output also displayed as GH Job Summary for internal / private repos? If not, we should be doing this in table / markdown format

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@saisatishkarra saisatishkarra saisatishkarra requested changes

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@pankajmouriyakong @saisatishkarra @CLAassistant @kong-security-bot