Repository navigation
ci: malware scan, OWASP ZAP baseline, OpenSSF Scorecard; pin all actions - #46
Merged
Merged
Conversation
- malware.yml: ClamAV scan of the source tree plus installed npm deps (installed with --ignore-scripts) on PRs, pushes to main and weekly. Signatures cached per ISO week; an infected file fails the job. - zap.yml: OWASP ZAP baseline (passive DAST) against a production build started in CI, on pushes to main and weekly; findings rated High/Medium/Low/Informational in the zap_scan artifact. No GitHub issues are opened, and it is not a merge gate. - scorecard.yml: OpenSSF Scorecard, published for the README badge and uploaded to code scanning. - Pin actions/checkout, actions/setup-node and github/codeql-action to commit SHAs in all workflows (Scorecard Pinned-Dependencies); Dependabot keeps them current. - README: Scorecard, CI, CodeQL and malware-scan badges. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The runner's AppArmor profile for freshclam only allows
/etc/clamav/freshclam.conf and /var/lib/clamav, so the custom config in
$RUNNER_TEMP failed ("Can't open/parse the config file"). Stop the
packaged updater service, run `sudo freshclam` with the system config,
scan /var/lib/clamav, and mirror the DB to ~/clamav-db for the weekly
cache. Verified as a non-root sudo user in ubuntu:24.04: cache round
trip is up to date, clean tree exits 0, EICAR is FOUND and exits 1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From an OpenSSF Scorecard run (6.2/10 on main): - Token-Permissions (0): release.yml granted packages/id-token write at the top level. Top level is now contents: read, with the write scopes only on the publishing job. - Pinned-Dependencies: node:22-alpine pinned to its multi-arch index digest in Dockerfile and intel/Dockerfile; a docker entry in dependabot.yml keeps the digest current. Both images build (arm64 local check: node v22.23.3). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three new security workflows, plus SHA-pinning for every action.
malware.ymlnpm ci --ignore-scripts, so install scripts never run). Fresh signatures each run; DB cached per ISO week so only daily diffs are fetched. An infected file fails the job.zap.ymlzap_scanartifact.allow_issue_writing: false, so no auto-opened issues.scorecard.ymlPinning:
actions/checkout,actions/setup-nodeandgithub/codeql-actionare now pinned to commit SHAs (with# vX.Y.Z) in all workflows. Every action in the repo is now SHA-pinned (Scorecard's Pinned-Dependencies check), and the github-actions Dependabot config keeps them current.README: Scorecard, CI, CodeQL and Malware-scan badges.
Verification
Eicar-Test-Signature FOUND, exit 1 (fails the job).zaproxy/action-baselineruns ZAP with--network=host, so it can reach the app onlocalhost:3000.malwareruns on this PR.zapandscorecardfirst run after merge:workflow_dispatch/pushneed the workflow on the default branch.A separate PR will add an OWASP Top 10:2025 assessment (
SECURITY.md), using ZAP and Scorecard results.🤖 Generated with Claude Code