ci: add Dependabot, CodeQL, and Bandit workflows (report-only) - #54
Open
ubercylon8 wants to merge 2 commits into
Open
ci: add Dependabot, CodeQL, and Bandit workflows (report-only)#54ubercylon8 wants to merge 2 commits into
ubercylon8 wants to merge 2 commits into
Conversation
Adds the ISACA ITGC Windows Endpoint Validation Bundle — a multi-binary
cyber-hygiene bundle producing auditor workpaper evidence (one JSON
sidecar per control + aggregated workpaper) for CISA-credentialed
auditors.
Architecture (mirrors the CIS Windows L1 precedent at 078f1409):
- 7 multi-binary validators, one per ITGC control family (am/cm/lm/ep/
br/ns/gv) for quarantine resilience.
- Each validator emits per-control evidence with CISA 2024 ECO domain,
COBIT 2019 objective, CIS v8 mapping, MITRE ATT&CK, and structured
Evidence map.
- Orchestrator writes three things to c:\F0\:
- bundle_results.json (standard PA fan-out)
- itgc_evidence_<id>.json (per-control auditor sidecar)
- itgc_audit_workpaper.json (aggregated workpaper)
Phase-2 milestone: 7 representative checks shipped (one per family) to
prove the architecture end-to-end. Remaining 24 controls land in
iteration 2 by lifting validators from CIS L1 (078f1409) + baseline
Defender (a3c923ae) and re-tagging with ITGC IDs per the plan.
ISACA module-coverage confirmation (per user request):
- cloud_identity (AM-006 MFA): handled by extending existing Entra
Tenant bundle 4f484076; PA already has MicrosoftGraphClient at
backend/src/services/defender/graph-client.ts. Permission scope
needs UserAuthenticationMethod.Read.All (manual Azure portal).
- endpoint_config / asset_discovery: NO new PA integration; runs
locally inside the F0RT1KA test binary.
- identity_audit (AM-001/003/004 + NS-003 LAPS): companion AD bundle
deferred to phase 3, no PA integration change.
- siem_integration (LM-005 / CM-004): implemented as LOCAL
Get-WinEvent queries. SIEM-mode (Splunk/Sentinel) deferred to v2.
Verified:
- Cross-build (windows/amd64/CGO=0): 7/7 validators OK + orchestrator
OK (3.8 MB).
- test_logger.go uses leaner CIS L1 lineage (avoids BundleResults
duplication with orchestrator_utils) + ISACA TestMetadata fields.
- Metadata header includes ISACA_CONTROLS / CISA_DOMAINS /
COBIT_OBJECTIVES parsed by PA's MetadataExtractor (companion commit
0e3d9ad in ProjectAchilles).
Refs: docs/PROPOSED_RUBRIC_V2.1_SIGNAL_QUALITY.md, ISACA bundle plan
(approved 2026-04-25).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three additions on a feature branch for review before merge to main:
1. .github/dependabot.yml
- github-actions: weekly Monday auto-PRs for action version bumps
- gomod: watches sample_tests/multistage_template (canonical reference;
51 per-test go.mod files use the same Prelude pin so updating the
template guides the rest)
- pip: watches utils/requirements.txt
All three open at most 3-5 PRs/week; you control merge.
2. .github/workflows/codeql.yml
- GitHub-native SAST for Go + Python
- security-extended query pack
- Autobuild best-effort (Prelude libraries are not provisioned in CI;
CodeQL analyzes whatever it can resolve)
- continue-on-error: true while we tune. Findings appear in the
Security tab; once the noise floor is understood, remove the flag
to start blocking PRs on new high/critical issues.
3. .github/workflows/bandit.yml
- Python SAST scoped to utils/ and limacharlie-iac/scripts/ only
(admin tooling, not test payloads)
- SARIF upload to Security tab
- Skipped for tests_source/ — Go test code is intentionally
adversarial and is covered by CodeQL with separate tuning
gosec was deliberately omitted: it would fire heavily on intentional
patterns under tests_source/ (registry tampering, file writes to c:\\F0,
LSASS access). Add later if and when CodeQL coverage proves insufficient.
All three workflows are non-blocking on first iteration. Triage findings,
then progressively tighten enforcement.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds three new CI artifacts to strengthen supply-chain hygiene and SAST coverage. All three are non-blocking on first iteration — findings surface in the Security tab so we can triage before tightening enforcement.
.github/dependabot.yml— weekly Monday auto-PRs forgithub-actions,gomod(template), andpip(utils/requirements.txt).github/workflows/codeql.yml— Go + Python SAST with thesecurity-extendedquery pack; autobuild is best-effort because the Prelude libraries are not provisioned in CI.github/workflows/bandit.yml— Python SAST scoped toutils/andlimacharlie-iac/scripts/(admin tooling).tests_source/Go is excluded — that's adversarial code by design and is covered by CodeQL with its own tuning.gosecwas deliberately omitted: would fire heavily on intentional patterns (registry tampering,c:\F0file writes, LSASS access). Reconsider if CodeQL coverage proves insufficient.Why report-only
The
tests_source/tree contains 51 deliberately adversarial Go programs. We don't yet know what the SAST noise floor looks like, so the workflows ship withcontinue-on-error: true. Once we've triaged the first scan, we can:continue-on-errorto start blocking PRs on new high/critical findingsTest plan
utils/Notes
🤖 Generated with Claude Code