feat(pr-summary): Security summary comment in PRs - #505

Merged

jackseceng merged 66 commits into

mainfrom

pr-security-comments

Apr 15, 2026

Commits on Apr 12, 2026

feat(pr-summary): Security summary comment in PRs
jackseceng
committed
d5dc982
fix(triggers): Remove branch ignore main
jackseceng
committed
4513a0d
fix(summary): Update security comment summary PR logic
jackseceng
committed
750989d
fix(linter-findings): update gha yaml to fix linter findings
jackseceng
committed
a2b124d
test(dockerfile): Downgrading alpine version to check if summary shows a vulnerability
jackseceng
committed
8e2ea2c
fix(workflow): Change trigger logic for security summary action
jackseceng
committed
a9de700
test(semgrep): Revert dockerfile change, deliberate semgrep issue used isntead to test summary
jackseceng
committed
fd554c7
feat(summary): add print statement in runner
jackseceng
committed
0bb848f
fix(summary): Update logic of all workflow to better trigger summary comment workflow
jackseceng
committed
604fc55
fix(summary): remove non-security checks from workflow dependency
jackseceng
committed
9200bd7
fix(summary): Adjust permissions and ubuntu version
jackseceng
committed
a746424
fix(codeql): update permissions for PR checks
jackseceng
committed
3f6151d
fix(codeql): update permissions
jackseceng
committed
957d11b
fix(codeql): update permissions
jackseceng
committed
7496f06
fix(pr-checks): update permissions
jackseceng
committed
810b293
fix(pr-checks): update permissions
jackseceng
committed
73cfaf7
fix(pr-checks): update permissions
jackseceng
committed
386842f
fix(pr-checks): update permissions
jackseceng
committed
8229b12
fix(pr-checks): update permissions
jackseceng
committed
1e6ea7a
fix(pr-checks): update permissions
jackseceng
committed
23db8c2
fix(pr-checks): update permissions
jackseceng
committed
aea8fba
ci(summary): Change summary trigger to review being ready instead of CI completion
jackseceng
committed
5ef644f
ci(summary): update url used to get security findings
jackseceng
committed
9909255
ci(container-scans): Reduce scope to just container related changes
jackseceng
committed
477028a
ci(yaml-files): Simplify GHA trigger conditions
jackseceng
committed
d7a32b1
ci(summary): Add additional logic to scrape security alerts
jackseceng
committed
f200472
ci(summary): add print statements for debugging
jackseceng
committed
7a5da10

Commits on Apr 15, 2026

ci(summary): add print statements to debug
jackseceng
committed
9c0e8fd
ci(summary): update PR check logic to show introduced vulnerabilities in PR
jackseceng
committed
d8db3a9
ci(summary): add vulnerabiltiy description to comment
jackseceng
committed
1a9de98
test(VULNERABILITY): Adding a DELIBERATLEY vulnerable docker image for testing
jackseceng
committed
de25937
ci(summary): Cache findings for large amounts of vulnerabilities
jackseceng
committed
71854c5
ci(trivy-test): update contianer config for trivy to test older versions
jackseceng
committed
44250e0
test(VULNERABILITY): new vulnerable ubuntu version for testing
jackseceng
committed
4760313
ci(summary): fix table formatting
jackseceng
committed
7ba90c3
ci(summary): update messaging
jackseceng
committed
4646ab7
ci(summary): update messaging format
jackseceng
committed
ea399de
fix(summary): fix syntax error
jackseceng
committed
871e50a
ci(summary): update the source and formatting of the detail table
jackseceng
committed
ed05d1c
ci(summary): update format
jackseceng
committed
def467a
ci(summary): adding markdown format to summary
jackseceng
committed
1303186
ci(summary): update messaging
jackseceng
committed
7e2439f
ci(summary): update messaging
jackseceng
committed
53f3da1
ci(summary): update messaging
jackseceng
committed
b17d18d
ci(summary): update table format
jackseceng
committed
f6e13d4
ci(summary): remove cve links
jackseceng
committed
925c69a
ci(summary): remove cve column
jackseceng
committed
6f33506
fix(dockerfile): revert to clean version
jackseceng
committed
7587c62
ci(gha-workflows): update triggers to activate on PR being ready for review
jackseceng
committed
9acc860
ci(codeql): update trigger logic
jackseceng
committed
82d53a4
fix(index): fix integrity issue found by semgrep
jackseceng
committed
25cc5c6
ci(workflows): re-factor all workflows to use dependant summary step instead of ready for review trigger
jackseceng
committed
c365984
ci(security): Adjust triggers and made security results only focus on latest commit
jackseceng
committed
66cc482
fix(comment): add || true guards to prevent premature exit under bash -e
jackseceng
committed
a04015c
ci(container): migrate build to Blacksmith runner and actions
jackseceng
committed
8d16cb7
ci(lint): remove ready for review trigger
jackseceng
committed
d8f6f6b
ci(lint): revert removal of ready for review trigger
jackseceng
committed
1fc0fb4
ci(lint): re-apply removal of ready for review trigger
jackseceng
committed
66e5e12
ci(container): revert migration to Blacksmith runner and actions
jackseceng
committed
8cf220a
ci(security): rename gha file
jackseceng
committed
f94105c
ci(security): rename security file
jackseceng
committed
5eb56d3
fix(comment): add || true guards to grep and arithmetic expansion to prevent premature exit under bash -e
jackseceng
committed
20d01f9
ci(security): skip scans when irrelevant files change, always run comment step
jackseceng
committed
d4b6e4a
fix(comment): only fail job when scans ran, remove per-commit SHA filter from alert query
jackseceng
committed
e580f66
fix(comment): count only HEAD SHA alerts for fail condition, show all open alerts in comment
jackseceng
committed
7d09ff3
fix(comment): use if block instead of bare [[ ]] && chain to avoid bash -e exit on false condition
jackseceng
committed
2249faf