Security Workflows

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/security-baseline.yml

@@ -0,0 +1,68 @@
+name: Security Checks
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      severity:
+        description: "Comma-separated Trivy severity levels that fail the scan (e.g. CRITICAL,HIGH,MEDIUM)"
+        type: string
+        default: CRITICAL,HIGH
+    secrets:
+      GITLEAKS_LICENSE:
+        description: "Gitleaks license key (required for organisation repositories)"
+        required: false
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+permissions:
+  contents: read
+
+jobs:
+  secrets:
+    name: Secret Scan - Gitleaks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+          GITLEAKS_ENABLE_COMMENTS: "false"
+
+  trivy:
+    name: Vulnerability and IaC Scan - Trivy
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: .trivy-cache
+          key: trivy-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: trivy-${{ runner.os }}-
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          exit-code: 1
+          severity: ${{ inputs.severity || 'CRITICAL,HIGH' }}
+          format: sarif
+          output: trivy.sarif
+          cache-dir: .trivy-cache
+      - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        if: always()
+        with:
+          sarif_file: trivy.sarif

.gitignore

@@ -1,18 +1,11 @@
-# Build and Release Folders
-bin-debug/
-bin-release/
-[Oo]bj/
-[Bb]in/
+# Editor
+.vscode/
+.idea/
+*.iml
 
-# Other files and folders
-.settings/
+# OS
+.DS_Store
+Thumbs.db
 
-# Executables
-*.swf
-*.air
-*.ipa
-*.apk
-
-# Project files, i.e. `.project`, `.actionScriptProperties` and `.flexProperties`
-# should NOT be excluded as they contain compiler settings and other important
-# information for Eclipse / Flash Builder.
+# Trivy cache (generated during CI runs)
+.trivy-cache/

README.md

@@ -1,2 +1,111 @@
-# platform-github-workflows
-A collection of GitHub reusable workflows
+# GitHub Workflows
+
+A collection of reusable GitHub Actions workflows for platform-wide security and CI standards.
+
+## Usage
+
+Reference workflows from this repo using the `uses` key with a pinned ref:
+
+```yaml
+jobs:
+  security:
+    uses: your-org/platform-github-workflows/.github/workflows/security-baseline.yml@main
+```
+
+Pin to a tag or SHA in production to avoid unexpected changes:
+
+```yaml
+    uses: your-org/platform-github-workflows/.github/workflows/security-baseline.yml@v1.0.0
+```
+
+---
+
+## Workflows
+
+### `security-baseline.yml` — Security Checks
+
+Runs secret scanning (Gitleaks) and vulnerability/IaC scanning (Trivy) against the calling repo.
+
+#### Inputs
+
+| Name | Type | Default | Description |
+|------|------|---------|-------------|
+| `severity` | `string` | `CRITICAL,HIGH` | Comma-separated Trivy severity levels that fail the scan. Valid values: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `UNKNOWN`. |
+
+#### Secrets
+
+| Name | Required | Description |
+|------|----------|-------------|
+| `GITLEAKS_LICENSE` | Yes (org repos) | Gitleaks license key. Not required for personal-account repos. Store as an org or repo secret named `GITLEAKS_LICENSE`. |
+
+#### Permissions required in the caller
+
+The workflow sets its own least-privilege permissions, but the calling workflow must grant:
+
+```yaml
+permissions:
+  contents: read
+  security-events: write  # needed for SARIF upload to GitHub Code Scanning
+  actions: read
+```
+
+#### Example — minimal
+
+```yaml
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  security:
+    uses: your-org/platform-github-workflows/.github/workflows/security-baseline.yml@main
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    secrets:
+      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+```
+
+#### Example — custom severity threshold
+
+```yaml
+jobs:
+  security:
+    uses: your-org/platform-github-workflows/.github/workflows/security-baseline.yml@main
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    with:
+      severity: CRITICAL,HIGH,MEDIUM
+    secrets:
+      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+```
+
+#### What it scans
+
+| Tool | Scope | Fails PR on |
+|------|-------|-------------|
+| [Gitleaks](https://github.com/gitleaks/gitleaks) | Full git history | Any detected secret |
+| [Trivy](https://github.com/aquasecurity/trivy) | Filesystem (deps + IaC) | Findings at or above `severity` threshold |
+
+Trivy results are uploaded to [GitHub Code Scanning](https://docs.github.com/en/code-security/code-scanning) as SARIF, even when the scan fails, so findings are always visible in the Security tab.
+
+---
+
+## Contributing
+
+### Adding a new workflow
+
+1. Add the workflow file under `.github/workflows/`
+2. Include `workflow_call:` in the `on:` block so it is callable
+3. Document it in this README under the **Workflows** section
+4. Pin all action dependencies to a full commit SHA and add a version comment
+
+### Updating action versions
+
+Dependabot is configured to open weekly PRs for action version bumps. Review and merge these to keep SHA pins current.