GovOPlaN/govoplan
1
0
Fork 0
Code Issues 12 Pull Requests Actions 4 Packages Projects Releases Wiki Activity

ci: enforce complete security audit coverage
Some checks failed
Dependency Audit / dependency-audit (push) Has been cancelled
Details
Security Audit / security-audit (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-30 01:40:36 +02:00
parent 1aea3e7c4f
commit f2e2eb5517
6 changed files with 315 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/SECURITY_AUDIT.md
View File

@@ -50,6 +50,10 @@ accept findings, but scanner execution errors and malformed JSON/SARIF reports
always fail the run. The manifest lists the expected, present, and missing
reports for that invocation. Validation and checksums use that explicit set, so
reusing a report directory cannot make stale output look like part of a new run.
It also contains `coverage_status` and structured `scanner_coverage` entries.
Every required scanner is recorded as `no-findings`, `findings`,
`scanner-failure`, or `skipped`; this makes an incomplete local run visible
without treating it as a clean audit.
The wrapper tags the toolbox image by a fingerprint of the Dockerfile,
`requirements-audit.txt`, and the Semgrep smoke-test inputs. If those inputs have
@@ -90,6 +94,12 @@ tools/checks/security-audit/run.sh --mode quick --scope current --update --build
- `ci`: quick plus Semgrep public registry rulesets, Trivy, pip-audit, npm audit.
- `full`: ci plus OSV-Scanner, jscpd, Radon, and Xenon.
The Gitea workflow uses `full` mode so its coverage contract includes every
scanner above. Missing scanners fail strict runs and all Actions runs, even
while actual findings remain report-only. Local report-only runs may finish
with missing tools for diagnostics, but their manifest is marked
`coverage_status: incomplete`.
Semgrep and Trivy are invoked with finding-sensitive exit codes. Their exit 1
is therefore a finding under the wrapper contract; higher exit codes, missing
output, invalid JSON/SARIF, and scanner error payloads are execution failures.
@@ -103,7 +113,7 @@ baseline.
## Gating
The initial Gitea workflow runs in report-only mode:
The Gitea workflow currently runs findings in report-only mode:
```bash
SECURITY_AUDIT_FAIL_ON_FINDINGS=0
@@ -119,7 +129,7 @@ SECURITY_AUDIT_FAIL_ON_FINDINGS=1
or run locally with:
```bash
tools/checks/security-audit/run.sh --mode ci --scope current --strict
tools/checks/security-audit/run.sh --mode full --scope govoplan --strict
```
## Audit Burndown Workflow