From 3b2847396eff6605a38c71954773bf52374405ec Mon Sep 17 00:00:00 2001 From: pvoore Date: Thu, 9 Jul 2026 11:26:06 +0530 Subject: [PATCH 1/5] fix: security work flow --- .github/workflows/security-scan.yml | 80 +++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 .github/workflows/security-scan.yml diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml new file mode 100644 index 0000000000..7cce1d3ed8 --- /dev/null +++ b/.github/workflows/security-scan.yml @@ -0,0 +1,80 @@ +name: Security Scan + +on: + pull_request: + branches: [master, main] + pull_request_target: + types: [opened, reopened] + schedule: + # Every day at 6:00 AM UTC + - cron: "0 6 * * *" + workflow_dispatch: + +permissions: + contents: read + +jobs: + trivy: + name: Trivy security scan + # Skip on pull_request_target — that event runs with full secrets and must + # never check out / execute PR-supplied code. See dependabot-notify below. + # Also skip on fork-based pull_request events. + if: github.event_name != 'pull_request_target' && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - name: Checkout code + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 + with: + scan-type: fs + ignore-unfixed: true + severity: 'HIGH,CRITICAL' + format: 'template' + template: '@/contrib/sarif.tpl' + output: 'trivy-results.sarif' + exit-code: '1' + env: + TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db + TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@b22c66273205240d86582638b860f9b25772b4d3 # v3 + # Fork PRs have restricted GITHUB_TOKEN permissions and cannot upload + # SARIF to Security tab. Keep scan behavior, but skip upload in forks. + if: always() && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) + with: + sarif_file: 'trivy-results.sarif' + + - name: Notify Slack on scheduled scan failure + if: failure() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') + uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0 + with: + payload: | + { + "text": ":rotating_light: Trivy detected HIGH/CRITICAL CVEs on master in ${{ github.repository }}\nRun: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\nFindings: ${{ github.server_url }}/${{ github.repository }}/security/code-scanning?query=is%3Aopen+tool%3ATrivy" + } + env: + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TRIVY_WEBHOOK_URL }} + + dependabot-notify: + name: Notify Slack on Dependabot PR + # IMPORTANT: This job uses pull_request_target which has full secrets access. + # Do NOT add a `checkout` step here — that would run PR-supplied code with secrets. + # This job's only purpose is to POST to Slack with metadata; nothing else. + if: github.event_name == 'pull_request_target' && github.actor == 'dependabot[bot]' + runs-on: ubuntu-latest + steps: + - name: Notify Slack + uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0 + with: + payload: | + { + "text": ":robot_face: Dependabot opened a PR in ${{ github.repository }}\nTitle: ${{ github.event.pull_request.title }}\nPR: ${{ github.event.pull_request.html_url }}" + } + env: + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TRIVY_WEBHOOK_URL }} From d92b84e0027c9f0263cf6599f8390891ccae4dbe Mon Sep 17 00:00:00 2001 From: pvoore Date: Thu, 9 Jul 2026 13:41:20 +0530 Subject: [PATCH 2/5] fix: fix fork Pr scan --- .github/workflows/security-scan.yml | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 7cce1d3ed8..4b0b45df74 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -14,11 +14,34 @@ permissions: contents: read jobs: + trivy-fork-pr: + name: Trivy security scan (fork PR) + # Fork PRs are untrusted: run scan with read-only permissions and no secrets. + if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout code + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 + with: + scan-type: fs + ignore-unfixed: true + severity: 'HIGH,CRITICAL' + format: 'table' + exit-code: '1' + env: + TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db + TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db + trivy: - name: Trivy security scan + name: Trivy security scan (trusted contexts) # Skip on pull_request_target — that event runs with full secrets and must # never check out / execute PR-supplied code. See dependabot-notify below. - # Also skip on fork-based pull_request events. + # This trusted job handles non-fork pull_request, schedule, and manual runs. if: github.event_name != 'pull_request_target' && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) runs-on: ubuntu-latest permissions: @@ -56,7 +79,7 @@ jobs: with: payload: | { - "text": ":rotating_light: Trivy detected HIGH/CRITICAL CVEs on master in ${{ github.repository }}\nRun: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\nFindings: ${{ github.server_url }}/${{ github.repository }}/security/code-scanning?query=is%3Aopen+tool%3ATrivy" + "text": ":rotating_light: Trivy detected HIGH/CRITICAL CVEs on ${{ github.ref_name }} in ${{ github.repository }}\nRun: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\nFindings: ${{ github.server_url }}/${{ github.repository }}/security/code-scanning?query=is%3Aopen+tool%3ATrivy" } env: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TRIVY_WEBHOOK_URL }} From 7e5f88b0b6dac33b96ca83d0b47c9fe976a8fa4f Mon Sep 17 00:00:00 2001 From: pvoore Date: Thu, 9 Jul 2026 17:39:50 +0530 Subject: [PATCH 3/5] ci: add Dependabot version updates (Maven, GitHub Actions, Docker) --- .github/dependabot.yml | 61 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..07c221e195 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,61 @@ +# Dependabot version updates. Security (CVE) updates are enabled separately in +# repo Settings > Code security and do not require an entry here. +version: 2 +updates: + # Java — root pom plus the nested v2 reactor (module dirs enumerated so every + # child pom is scanned; grouping keeps it to one PR per run). + - package-ecosystem: maven + directories: + - "/" + - "/v2" + - "/v2/*" + - "/v2/cdc-parent/*" + schedule: + interval: cron + cronjob: "0 11 * * 1" + timezone: "Asia/Kolkata" + open-pull-requests-limit: 10 + labels: + - dependencies + commit-message: + prefix: "build" + include: "scope" + groups: + maven-minor-and-patch: + update-types: + - minor + - patch + + # GitHub Actions — keeps the SHA-pinned actions in workflows current. + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: cron + cronjob: "0 11 * * 1" + timezone: "Asia/Kolkata" + open-pull-requests-limit: 5 + labels: + - dependencies + - github-actions + commit-message: + prefix: "build" + include: "scope" + groups: + github-actions: + patterns: + - "*" + + # Docker + - package-ecosystem: docker + directory: "/v2/flex-wordcount-python" + schedule: + interval: cron + cronjob: "0 11 * * 1" + timezone: "Asia/Kolkata" + open-pull-requests-limit: 5 + labels: + - dependencies + - docker + commit-message: + prefix: "build" + include: "scope" From 0828a380313828e3b989f714c64be45eff4f95c2 Mon Sep 17 00:00:00 2001 From: pvoore Date: Thu, 9 Jul 2026 17:39:50 +0530 Subject: [PATCH 4/5] ci: rename security workflow to security_scan_pr_schedule.yaml (match New Relic convention) --- .../{security-scan.yml => security_scan_pr_schedule.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{security-scan.yml => security_scan_pr_schedule.yaml} (100%) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security_scan_pr_schedule.yaml similarity index 100% rename from .github/workflows/security-scan.yml rename to .github/workflows/security_scan_pr_schedule.yaml From 68e2648c320a17c54823b3515828674180d41864 Mon Sep 17 00:00:00 2001 From: pvoore Date: Fri, 17 Jul 2026 13:08:26 +0530 Subject: [PATCH 5/5] ci: clarify schedule comment with IST time to match aws-log-ingestion convention Co-Authored-By: Claude Sonnet 5 --- .github/workflows/security_scan_pr_schedule.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security_scan_pr_schedule.yaml b/.github/workflows/security_scan_pr_schedule.yaml index 4b0b45df74..fa65a0ef71 100644 --- a/.github/workflows/security_scan_pr_schedule.yaml +++ b/.github/workflows/security_scan_pr_schedule.yaml @@ -6,7 +6,7 @@ on: pull_request_target: types: [opened, reopened] schedule: - # Every day at 6:00 AM UTC + # Every day at 11:30 AM IST (6:00 AM UTC) - cron: "0 6 * * *" workflow_dispatch: