From 9c9a15010b08844a013ecfe9d261360d6e7e05dd Mon Sep 17 00:00:00 2001 From: Sibu Thomas Mathew Date: Sun, 7 Jun 2026 14:23:13 +0200 Subject: [PATCH 1/5] ci: Pinning workflows to SHAs Signed-off-by: Sibu Thomas Mathew --- .github/workflows/security.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 6d18a1c..99a5f92 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -26,7 +26,7 @@ jobs: actions: read steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/cache@v4 + - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: .trivy-cache key: trivy-${{ runner.os }}-${{ github.run_id }} @@ -40,7 +40,7 @@ jobs: format: sarif output: trivy.sarif cache-dir: .trivy-cache - - uses: github/codeql-action/upload-sarif@v3 + - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 if: always() with: sarif_file: trivy.sarif From ecf6b8961f20b7757f2bde8d2191510c95f8ad43 Mon Sep 17 00:00:00 2001 From: Sibu Thomas Mathew Date: Sun, 7 Jun 2026 14:35:34 +0200 Subject: [PATCH 2/5] ci: Enable concurrency Signed-off-by: Sibu Thomas Mathew --- .github/workflows/security.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 99a5f92..da5e698 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -6,6 +6,10 @@ on: branches: [main] workflow_dispatch: +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} + permissions: contents: read From f74516f25f2e9d9e1e47d7698a1ba1ebd8752127 Mon Sep 17 00:00:00 2001 From: Sibu Thomas Mathew Date: Sun, 7 Jun 2026 14:37:46 +0200 Subject: [PATCH 3/5] ci: Adding workflow timeout Signed-off-by: Sibu Thomas Mathew --- .github/workflows/security.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index da5e698..9715e5b 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -17,6 +17,7 @@ jobs: secrets: name: Secret Scan - Gitleaks runs-on: ubuntu-latest + timeout-minutes: 10 steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 @@ -24,6 +25,7 @@ jobs: trivy: name: Vulnerability and IaC Scan - Trivy runs-on: ubuntu-latest + timeout-minutes: 20 permissions: contents: read security-events: write From 1de2e2bf55a7a934ba3e288230b36a2cea4dfad5 Mon Sep 17 00:00:00 2001 From: Sibu Thomas Mathew Date: Sun, 7 Jun 2026 14:39:18 +0200 Subject: [PATCH 4/5] ci: AuthZ for Gitleaks Signed-off-by: Sibu Thomas Mathew --- .github/workflows/security.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 9715e5b..9bf51ad 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -20,7 +20,11 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + fetch-depth: 0 - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} trivy: name: Vulnerability and IaC Scan - Trivy From 8a028ee5b0c9711207a5927de80e1f0b7ab4aefb Mon Sep 17 00:00:00 2001 From: Sibu Thomas Mathew Date: Sun, 7 Jun 2026 15:34:37 +0200 Subject: [PATCH 5/5] docs: Update README Signed-off-by: Sibu Thomas Mathew --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index dddc8d3..0bb56d3 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ A template repository for bootstrapping secure GitHub projects. Copy these files | File | Purpose | |------|---------| -| `.github/workflows/security.yml` | CI pipeline: secret scanning (Gitleaks) + vulnerability/IaC scanning (Trivy) on every push and PR | +| `.github/workflows/security.yml` | CI pipeline: secret scanning (Gitleaks) + vulnerability/IaC scanning (Trivy); triggers on push, PR, and manual dispatch; Trivy findings uploaded to the GitHub Security tab; stale PR runs cancelled automatically | | `.github/dependabot.yml` | Weekly automated dependency updates for GitHub Actions, Terraform, and Docker | | `.gitleaks.toml` | Gitleaks configuration; add allowlist entries for test fixtures here | | `.trivyignore` | Document accepted CVEs here with justification |