ci: add security scanning workflows (#123)

.github/dependabot.yaml

@@ -7,6 +7,8 @@ updates:
  time: "06:00"
  timezone: "America/Chicago"
  labels: []
+ commit-message:
+ prefix: "ci"
  groups:
  github-actions:
  patterns:
@@ -19,8 +21,15 @@ updates:
  time: "06:00"
  timezone: "America/Chicago"
  labels: []
+ commit-message:
+ prefix: "chore"
  open-pull-requests-limit: 15
  groups:
  x:
  patterns:
  - "golang.org/x/*"
+ ignore:
+ # Ignore patch updates for all dependencies to reduce PR noise
+ - dependency-name: "*"
+ update-types:
+ - version-update:semver-patch

.github/workflows/scorecard.yml

@@ -0,0 +1,46 @@
+name: OpenSSF Scorecard
+
+on:
+ branch_protection_rule:
+ schedule:
+ # Run weekly on Wednesdays at 7:27 UTC
+ - cron: "27 7 * * 3"
+ push:
+ branches:
+ - main
+
+permissions: read-all
+
+jobs:
+ analysis:
+ name: Scorecard analysis
+ runs-on: ubuntu-latest
+ permissions:
+ security-events: write
+ id-token: write
+
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v4
+ with:
+ persist-credentials: false
+
+ - name: Run analysis
+ uses: ossf/scorecard-action@v2.4.0
+ with:
+ results_file: results.sarif
+ results_format: sarif
+ repo_token: ${{ secrets.GITHUB_TOKEN }}
+ publish_results: true
+
+ - name: Upload artifact
+ uses: actions/upload-artifact@v4
+ with:
+ name: SARIF file
+ path: results.sarif
+ retention-days: 5
+
+ - name: Upload to code-scanning
+ uses: github/codeql-action/upload-sarif@v3
+ with:
+ sarif_file: results.sarif

.github/workflows/security.yaml

@@ -0,0 +1,96 @@
+name: security
+
+on:
+ push:
+ branches:
+ - main
+ pull_request:
+ schedule:
+ # Run every day at 10:00 UTC (6:00 AM ET / 3:00 AM PT)
+ - cron: "0 10 * * *"
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+# Cancel in-progress runs for pull requests when developers push
+# additional changes
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+ codeql:
+ name: CodeQL Analysis
+ runs-on: ubuntu-latest
+ permissions:
+ security-events: write
+ actions: read
+ contents: read
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+
+ - name: Setup Go
+ uses: actions/setup-go@v5
+ with:
+ go-version-file: "go.mod"
+
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@v3
+ with:
+ languages: go
+
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@v3
+ with:
+ category: "/language:go"
+
+ trivy-repo:
+ name: Trivy Filesystem Scan
+ runs-on: ubuntu-latest
+ permissions:
+ security-events: write
+ contents: read
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+
+ - name: Run Trivy vulnerability scanner in repo mode
+ uses: aquasecurity/trivy-action@0.28.0
+ with:
+ scan-type: "fs"
+ scan-ref: "."
+ format: "sarif"
+ output: "trivy-results.sarif"
+ severity: "CRITICAL,HIGH"
+
+ - name: Upload Trivy scan results to GitHub Security tab
+ uses: github/codeql-action/upload-sarif@v3
+ with:
+ sarif_file: "trivy-results.sarif"
+ category: "Trivy-Filesystem"
+
+ trivy-image:
+ name: Trivy Docker Image Scan
+ runs-on: ubuntu-latest
+ permissions:
+ security-events: write
+ contents: read
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+
+ - name: Run Trivy vulnerability scanner on latest image
+ uses: aquasecurity/trivy-action@0.28.0
+ with:
+ image-ref: "ghcr.io/coder/code-marketplace:latest"
+ format: "sarif"
+ output: "trivy-image-results.sarif"
+ severity: "CRITICAL,HIGH"
+
+ - name: Upload Trivy scan results to GitHub Security tab
+ uses: github/codeql-action/upload-sarif@v3
+ with:
+ sarif_file: "trivy-image-results.sarif"
+ category: "Trivy-Docker"

CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Added
+
+- Automated security scanning workflows for improved supply chain security:
+ - CodeQL analysis for Go code vulnerability scanning
+ - Trivy scanning for Go dependencies and Docker images
+ - OpenSSF Scorecard for security best practices assessment
+ - Results uploaded to GitHub Security tab for centralized monitoring
+
+### Changed
+
+- Enhanced Dependabot configuration with commit message prefixes and patch update
+ filtering to reduce PR noise while maintaining security update coverage.
 - Update the Kubernetes Deployment `spec.strategy.type` field to be of type `Recreate`
  in order to properly handle upgrades/restarts as the default deployment creates a PVC
  of type `ReadWriteOnce` and could only be assigned to one replica.