feat: Add security-gates and update README - #1310
Conversation
📝 WalkthroughWalkthroughThe pull request adds a GitHub Actions security-gates workflow for ChangesSecurity gates
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
2 similar comments
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| actions: read | ||
| contents: read | ||
| security-events: write | ||
| secrets: inherit |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/security-gates.yml (1)
12-18: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winMake
validateperform a real check or remove it.
echo "Validation successful"always passes and does not validate the workflow or repository. If this job is intended to gatesecurity-gates, addneeds: validateto the reusable-workflow job and run a meaningful validation command. Otherwise, remove this job to avoid a misleading green check.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/security-gates.yml around lines 12 - 18, Update the validate job to either run a meaningful repository or workflow validation and add needs: validate to the security-gates job, or remove validate entirely if it is not a real gate; do not retain the unconditional echo-only check.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/security-gates.yml:
- Line 19: Update the reusable workflow reference in the security-gates
configuration to replace the mutable `@master` ref with the validated full-length
commit SHA for Trendyol/security-actions. Keep the existing workflow path
unchanged.
- Line 24: Replace the broad secrets: inherit configuration in the reusable
workflow invocation with explicit mappings for APPSEC_CA, APPSEC_ELASTIC_URL,
APPSEC_ELASTIC_USER, APPSEC_ELASTIC_PASS, and SLACK_WEBHOOK_URL, passing only
those secrets to the called workflow.
---
Nitpick comments:
In @.github/workflows/security-gates.yml:
- Around line 12-18: Update the validate job to either run a meaningful
repository or workflow validation and add needs: validate to the security-gates
job, or remove validate entirely if it is not a real gate; do not retain the
unconditional echo-only check.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d77f7415-ba64-417e-8f8b-fde2966046b4
📒 Files selected for processing (2)
.github/workflows/security-gates.ymlREADME.md
| run: echo "Validation successful" | ||
|
|
||
| security-gates: | ||
| uses: Trendyol/security-actions/.github/workflows/security-gates.yml@master |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sha="$(gh api repos/Trendyol/security-actions/commits/master --jq '.sha')"
printf 'Current master SHA: %s\n' "$sha"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
--jq '.content' | base64 --decode | sed -n '1,220p'Repository: Trendyol/stove
Length of output: 7334
Pin the reusable workflow to an immutable commit.
@master lets the called workflow change without a change in Trendyol/stove. Pin this call to the full-length commit SHA that you validate before merging.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 19-19: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security-gates.yml at line 19, Update the reusable
workflow reference in the security-gates configuration to replace the mutable
`@master` ref with the validated full-length commit SHA for
Trendyol/security-actions. Keep the existing workflow path unchanged.
| actions: read | ||
| contents: read | ||
| security-events: write | ||
| secrets: inherit |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sha="$(gh api repos/Trendyol/security-actions/commits/master --jq '.sha')"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
--jq '.content' | base64 --decode | rg -n 'workflow_call|secrets:|secrets\.'Repository: Trendyol/stove
Length of output: 447
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sha="$(gh api repos/Trendyol/security-actions/commits/master --jq '.sha')"
echo "called workflow:"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
--jq '.content' | base64 --decode | nl -ba | sed -n '1,180p'
echo
echo "caller usage:"
if [ -f .github/workflows/security-gates.yml ]; then
nl -ba .github/workflows/security-gates.yml | sed -n '1,120p'
fiRepository: Trendyol/stove
Length of output: 209
🏁 Script executed:
#!/bin/bash
set -euo pipefail
caller_file=".github/workflows/security-gates.yml"
echo "caller file:"
if [ -f "$caller_file" ]; then
awk '{printf "%6d\t%s\n", NR, $0}' "$caller_file" | sed -n '1,120p'
else
echo "missing $caller_file"
fi
echo
echo "called workflow refs/secrets:"
sha="$(gh api repos/Trendyol/security-actions/commits/master --jq '.sha')"
for f in .github/workflows/*.yml; do
if [ "$(gh api -XGET "repos/Trendyol/security-actions/contents/$f?ref=$sha" --jq '.type == \"file\"" 2>/dev/null || true)" == "true" ]; then
content="$(gh api "repos/Trendyol/security-actions/contents/$f?ref=$sha" --jq '.type == "file" and .content' 2>/dev/null || true)"
if [ "$content" = "true" ]; then
echo "--- $f (maybe no content) ---"
else
echo "--- $f ---"
fi
fi
done
echo
echo "called workflow security-gates.yml:"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
--jq '.content' | awk '{printf "%6d\t%s\n", NR, $0}' | sed -n '1,180p'
echo
echo "called workflow env var usages:"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
--jq '.content' | java -jar /dev/null 2>/dev/null || awk '
/secrets\./ || /env:/ || /curl -X POST/ || /GITHUB_EVENT_PATH/ || /POST\/|PUT\/$/ || /X-Slack|Authorization:/ {
print NR "\t" $0
}'
echo
echo "github docs excerpt via web page text unavailable here; checking if gh docs command exists"
if command -v gh >/dev/null 2>&1; then
gh --version
fiRepository: Trendyol/stove
Length of output: 888
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sha="$(gh api repos/Trendyol/security-actions/commits/master --jq '.sha')"
echo "called workflow:"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
--jq '.content' | awk '{printf "%6d\t%s\n", NR, $0}' | sed -n '1,180p'
echo
echo "secrets/env/url matches in called workflow:"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
--jq '.content' | awk '
/secrets\./{print NR"\n"$0}
/env:/||/curl -X POST/||/POST\/|PUT\/$/||/SLACK_WEBHOOK_URL/||/APPSEC_ELASTIC/||/APPSEC_CA'Repository: Trendyol/stove
Length of output: 11236
Pass only the secrets required by the called workflow.
This reusable workflow reads APPSEC_CA, APPSEC_ELASTIC_URL, APPSEC_ELASTIC_USER, APPSEC_ELASTIC_PASS, and SLACK_WEBHOOK_URL. secrets: inherit also makes any other caller secrets available to that repository-owned workflow; drop it if unused, or pass only those required secrets explicitly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security-gates.yml at line 24, Replace the broad secrets:
inherit configuration in the reusable workflow invocation with explicit mappings
for APPSEC_CA, APPSEC_ELASTIC_URL, APPSEC_ELASTIC_USER, APPSEC_ELASTIC_PASS, and
SLACK_WEBHOOK_URL, passing only those secrets to the called workflow.
Source: Linters/SAST tools
2 participants
This PR adds security-gates workflow and updates README with OpenSSF Scorecard badge.
Summary by CodeRabbit