Reusable Security Hardening Pipeline
uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@0.6.7
Triggers
- Reusable (called by other workflows)
Permissions
| Scope | Access |
|---|---|
contents |
read |
security-events |
write |
actions |
read |
pull-requests |
write |
checks |
write |
id-token |
write |
Inputs
| Input | Description | Required | Default |
|---|---|---|---|
scanners |
Comma-separated list of scanners to run (codeql, opengrep, bandit, gitleaks, container, infrastructure, trivy-iac, ch... string | No | all |
scan_type |
(Deprecated) Legacy scan type selector. Prefer the scanners input. string | No | — |
python_version |
Python version to use string | No | 3.12 |
aws_region |
AWS region for infrastructure scans string | No | us-east-1 |
iac_path |
Directory that contains infrastructure-as-code (Terraform) files string | No | infrastructure |
post_pr_comment |
Whether to post PR comments boolean | No | True |
enable_code_security |
Whether GitHub Code Security is enabled for this repository (required for CodeQL scanning) boolean | No | False |
clamav_scan_path |
Path for ClamAV to scan (file, directory, or archive). Defaults to repository root. string | No | . |
allow_failure |
Whether to allow the workflow to continue when vulnerabilities are found above the severity threshold. When false, sc... boolean | No | True |
severity_threshold |
Minimum severity level that will cause job failure when allow_failure is false. Options: low, medium, high, critical string | No | high |
CodeQL Options
| Input | Description | Required | Default |
|---|---|---|---|
codeql_languages |
Comma-separated list of languages for CodeQL analysis (e.g., "python,javascript"). Leave empty for auto-detection. string | No | — |
codeql_config_file |
Path to CodeQL config file. Leave empty to auto-detect project config or generate one. string | No | — |
codeql_query_suite |
CodeQL query suite to use (security-extended, security-and-quality, or default). Ignored if codeql_config_file is set. string | No | security-extended,security-and-quality |
codeql_scan_paths |
Comma-separated list of paths to scan (empty = scan everything). Ignored if codeql_config_file is set. string | No | — |
codeql_ignore_paths |
Comma-separated list of paths to ignore. Ignored if codeql_config_file is set. string | No | **/node_modules/**,**/venv/**,**/__pycache__/** |
Bandit Options
| Input | Description | Required | Default |
|---|---|---|---|
bandit_config_file |
Path to Bandit configuration file (e.g. pyproject.toml, .bandit). Passed as bandit -c flag. string | No | — |
Gitleaks Options
| Input | Description | Required | Default |
|---|---|---|---|
gitleaks_enable_comments |
Enable GitLeaks inline PR comments (requires GITLEAKS_LICENSE) boolean | No | True |
gitleaks_notify_user_list |
Comma-separated list of GitHub usernames to notify on secret detection (e.g., "@user1,@user2") string | No | — |
gitleaks_enable_summary |
Enable GitLeaks job summary boolean | No | True |
gitleaks_enable_upload_artifact |
Enable uploading SARIF artifact when secrets are detected boolean | No | True |
gitleaks_config |
Path to a gitleaks configuration file (e.g., "path/to/gitleaks.toml") string | No | — |
ZAP (DAST) Options
| Input | Description | Required | Default |
|---|---|---|---|
zap_scan_mode |
how to obtain a running target: url (already running), docker-run (run a single container), compose (run docker compose) string | No | url |
zap_config_file |
optional config file (YAML or JSON) to define targets, scan type, and options. When provided, it takes precedence ove... string | No | — |
zap_target_urls |
comma-separated list of target URLs (required for baseline/full) string | No | — |
zap_healthcheck_url |
optional URL to poll until ready (defaults to first target URL) string | No | — |
zap_app_image_ref |
when scan_mode=docker-run, container image to start string | No | — |
zap_app_ports |
when scan_mode=docker-run, comma-separated port mappings (e.g., 8080:8080,3000:3000) string | No | 8080:8080 |
zap_compose_file |
when scan_mode=compose, path to docker compose file string | No | docker-compose.yml |
zap_scan_type |
scan type: baseline (passive), full (active), api (OpenAPI/Swagger) string | No | baseline |
zap_api_spec |
when scan_type=api, URL or file path to OpenAPI/Swagger spec string | No | — |
zap_max_duration_minutes |
max minutes per target for ZAP to run number | No | 10 |
OSV (Dependency) Options
| Input | Description | Required | Default |
|---|---|---|---|
osv_scan_path |
path to scan for lockfiles and dependency manifests string | No | . |
osv_lockfile |
specific lockfile path to scan (auto-discovers if empty) string | No | — |
osv_recursive |
scan subdirectories recursively for lockfiles boolean | No | True |
Dependency Review Options
| Input | Description | Required | Default |
|---|---|---|---|
dependency_review_vulnerability_check |
Dependency Review: enable vulnerability checking boolean | No | True |
dependency_review_license_check |
Dependency Review: enable license compliance checking boolean | No | False |
dependency_review_allow_licenses |
Dependency Review: comma-separated SPDX license identifiers to allow string | No | — |
dependency_review_deny_licenses |
Dependency Review: comma-separated SPDX license identifiers to deny string | No | — |
Secrets
| Secret | Description | Required |
|---|---|---|
AWS_ACCOUNT_ID |
AWS Account ID for infrastructure scans | No |
GITLEAKS_LICENSE |
License key for GitLeaks scans within a Github Organization. Obtain from https://gitleaks.io | No |
Jobs
scan-coordinator — Scan Coordinator
Runs on: ubuntu-latest · Condition: ${{ !cancelled() }}
Steps:
- Resolve scanner selection
code-quality-linting — Code Quality & Linting
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_lint == 'true'
scanner-codeql — CodeQL Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_codeql == 'true'
scanner-opengrep — OpenGrep Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_opengrep == 'true'
scanner-bandit — Bandit Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_bandit == 'true'
scanner-gitleaks — Gitleaks Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_gitleaks == 'true'
scanner-clamav — ClamAV Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_clamav == 'true'
scanner-container — Container Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_container == 'true'
scanner-infrastructure — Infrastructure Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_infrastructure == 'true'
scanner-sbom — SBOM Generator
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_sbom == 'true'
scanner-trivy-iac — Trivy IaC Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_trivy_iac == 'true'
scanner-checkov — Checkov Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_checkov == 'true'
scanner-trivy-container — Trivy Container Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_trivy_container == 'true'
scanner-grype — Grype Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_grype == 'true'
scanner-zap — ZAP (DAST) Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_zap == 'true'
scanner-osv — OSV Dependency Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_osv == 'true'
scanner-dependency-review — Dependency Review Scanner
Depends on: scan-coordinator · Condition: needs.scan-coordinator.outputs.run_dependency_review == 'true'
security-summary — Security Hardening Summary
Runs on: ubuntu-latest · Depends on: scan-coordinator, code-quality-linting, scanner-codeql, scanner-opengrep, scanner-bandit, scanner-gitleaks, scanner-clamav, scanner-container, scanner-infrastructure, scanner-sbom, scanner-trivy-iac, scanner-checkov, scanner-trivy-container, scanner-grype, scanner-zap, scanner-osv, scanner-dependency-review · Condition: always()
Steps:
- Download CodeQL artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download OpenGrep artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download Bandit artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download GitLeaks artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download ClamAV artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download Container artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download Infrastructure artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download Trivy IaC artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download Checkov artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download Trivy Container artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download Grype artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download ZAP artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download OSV artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download Dependency Review artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download Linting artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download SBOM artifacts —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Download all scanner summaries —
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c - Copy scanner summaries to expected locations
- Combine scanner summaries into security report
- Generate overall summary
- Get job ID —
huntridge-labs/argus/.github/actions/get-job-id@0.6.7 - Upload comprehensive security report —
actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f - Comment PR with security summary —
actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd