Repository navigation
ci: one security scan (SAST, Trivy, SBOM, ZAP DAST); local SAST with MicroHealth's rules - #19
Merged
Merged
Conversation
…MicroHealth's rules Replace sast.yml with security-scan.yml, the caller of MicroHealthLLC/sast-rules' shared security-scan.yml @ 341cd54 (v2026.10.5): Opengrep SAST, Trivy, the CycloneDX SBOM and ZAP DAST in parallel, one security-report. Every scanner is on. Runs on pushes to main (the default branch, so release scans feed MicroHealth's reports) and integration, every PR (diff SAST against the base), nightly and on dispatch. ZAP scans vars.ZAP_TARGET_URL and is reported not_run until it is set. It does not gate releases; the Tests workflow still does. Local: scripts/sast.sh copied unchanged from sast-rules/local/sast.sh (it reads the workflow pin); scripts/check.sh runs the guard tests, the host unit tests, then SAST. A SecurityScan guard (test_supply_chain) fails if the scan leaves security-scan.yml, a scanner is switched off, or local SAST is unwired. SECURITY.md, README and AI_RULES updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces
sast.yml(PR #18, already merged) with onesecurity-scan.ymlcalling MicroHealthLLC/sast-rules' sharedsecurity-scan.yml@341cd54(v2026.10.5): SAST (Opengrep with MicroHealth's rules), Trivy, CycloneDX SBOM and ZAP DAST in parallel, onesecurity-report. Every scanner is on.main(the default branch; release scans feed MicroHealth's reports) andintegration, every PR (SAST diff vs. base, artifacts only), nightly, dispatch.vars.ZAP_TARGET_URL; until set, ZAP is reportednot_runwith the reason (not a failure). SimplrSSH has no web endpoint, so it may stay that way.audit(esp-idf-sbom/NVD) remains the firmware CVE check.scripts/sast.sh(copied unchanged from sast-rules) andscripts/check.sh(guards, host tests, SAST).test_supply_chain.SecurityScanfails if a scanner is switched off or local SAST is unwired.Checks run locally: guard tests (91 OK), actionlint 1.7.7 (clean), ruff 0.16.9 (clean; CI pins 0.16.10). Not run locally: host C++ tests (no cmake here; no C++ changed) and
scripts/sast.sh(no ECR login on this machine).Merging releases the next patch (firmware unchanged).
🤖 Generated with Claude Code