1# Semgrep SAST — GitHub Actions
2name: SAST Scan
3 
4on: [pull_request]
5 
6jobs:
7  semgrep:
8    name: SAST with Semgrep
9    runs-on: ubuntu-latest
10    container:
11      image: semgrep/semgrep
12    steps:
13    - uses: actions/checkout@v4
14 
15    - name: Run Semgrep
p/owasp-top-ten = curated rules for OWASP Top 10
16      run: |
17        semgrep scan           --config p/owasp-top-ten           --config p/secrets           --config p/python           --sarif           --output semgrep-results.sarif           --error          # Fail build on findings
18 
19    - name: Upload SARIF to GitHub Security tab
20      uses: github/codeql-action/upload-sarif@v3
--error causes non-zero exit (build fails) on any finding
21      if: always()       # Upload even if scan found issues
22      with:
23        sarif_file: semgrep-results.sarif
SARIF = industry standard format for security findings
24        category: semgrep

1# Trivy — container image scanning + SCA in one tool
2# Trivy scans both OS packages (apk/apt/rpm) and language packages (pip/npm/go)
3name: Container Security Scan
4 
5on:
6  push:
7    branches: [main]
8  pull_request:
9 
10jobs:
11  trivy-scan:
12    runs-on: ubuntu-latest
13    steps:
14    - uses: actions/checkout@v4
15 
16    - name: Build image
17      run: docker build -t myapp:${{ github.sha }} .
18 
19    - name: Run Trivy container scan
20      uses: aquasecurity/trivy-action@master
21      with:
22        image-ref: myapp:${{ github.sha }}
23        format: sarif
severity: CRITICAL,HIGH — avoid alert fatigue from Low/Medium
24        output: trivy-results.sarif
25        severity: CRITICAL,HIGH      # Only report C/H
ignore-unfixed: skip CVEs where no patch exists yet
26        exit-code: '1'               # Fail on findings
27        ignore-unfixed: true         # Ignore CVEs with no patch yet
28 
29    - name: Upload Trivy results
30      uses: github/codeql-action/upload-sarif@v3
31      if: always()
32      with:
33        sarif_file: trivy-results.sarif
34        category: trivy-container
fs scan also catches Python/Node/Go vulnerable packages
35 
36    # Also scan filesystem (SCA for Python/Node/Go deps)
37    - name: Run Trivy filesystem scan
38      uses: aquasecurity/trivy-action@master
39      with:
40        scan-type: fs
41        scan-ref: .
42        format: table
43        severity: CRITICAL,HIGH
44        exit-code: '1'

1# gitleaks pre-commit hook + CI enforcement
2# Step 1: Install gitleaks pre-commit hook (developer machine)
3# .pre-commit-config.yaml
4repos:
5  - repo: https://github.com/gitleaks/gitleaks
6    rev: v8.18.2
7    hooks:
8      - id: gitleaks
Pre-commit hook blocks commits with secrets on dev machine
9        # gitleaks will scan staged files before each commit
10        # If a secret is found, the commit is blocked with the finding
11 
12# Step 2: CI enforcement (GitHub Actions)
13name: Secret Scanning
14 
15on: [push, pull_request]
16 
17jobs:
18  gitleaks:
19    runs-on: ubuntu-latest
20    steps:
21    - uses: actions/checkout@v4
22      with:
23        fetch-depth: 0       # Full history — scan all commits in the PR
fetch-depth: 0 ensures full PR history is scanned, not just HEAD
24 
25    - uses: gitleaks/gitleaks-action@v2
26      env:
27        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28        # GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}  # For org-level scan
29 
30# Step 3: Historical audit (run once on existing repos)
31# docker run --rm -v $(pwd):/repo zricethezav/gitleaks \
32#   detect --source /repo --report-format sarif \
Historical audit — run this once on all existing repos
33#   --report-path gitleaks-report.sarif
34 
35# gitleaks.toml — custom rules (optional)
36# [rules]
37#   [[rules.rules]]
38#     description = "Internal API key pattern"
39#     regex = 'MYCO-[A-Z0-9]{32}'
40#     tags = ["key", "myco"]