Skip to content

feat: Add security-gates and update README #1310

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
emrecanvurallll wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat: Add security-gates and update README #1310

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
57012e2
Add security-gates workflow and update README
emrecanvurallll Aug 3, 2026
1436547
Add security-gates workflow and update README
emrecanvurallll Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/security-gates.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: Security Gates

on:
push:
branches: [main, master]
pull_request:
branches: [main, master]

permissions: {}

jobs:
validate:
runs-on: ubuntu-latest
steps:
- name: Validate Workflow
run: echo "Validation successful"

security-gates:
uses: Trendyol/security-actions/.github/workflows/security-gates.yml@master

@coderabbitai coderabbitai Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sha="$(gh api repos/Trendyol/security-actions/commits/master --jq '.sha')"
printf 'Current master SHA: %s\n' "$sha"

gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
  --jq '.content' | base64 --decode | sed -n '1,220p'

Repository: Trendyol/stove

Length of output: 7334

Pin the reusable workflow to an immutable commit.

@master lets the called workflow change without a change in Trendyol/stove. Pin this call to the full-length commit SHA that you validate before merging.

🧰 Tools
🪛 zizmor (1.29.0)

[warning] 19-19: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow

(secrets-inherit)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/security-gates.yml at line 19, Update the reusable
workflow reference in the security-gates configuration to replace the mutable
`@master` ref with the validated full-length commit SHA for
Trendyol/security-actions. Keep the existing workflow path unchanged.

permissions:
actions: read
contents: read
security-events: write
secrets: inherit

@coderabbitai coderabbitai Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sha="$(gh api repos/Trendyol/security-actions/commits/master --jq '.sha')"

gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
  --jq '.content' | base64 --decode | rg -n 'workflow_call|secrets:|secrets\.'

Repository: Trendyol/stove

Length of output: 447

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sha="$(gh api repos/Trendyol/security-actions/commits/master --jq '.sha')"

echo "called workflow:"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
  --jq '.content' | base64 --decode | nl -ba | sed -n '1,180p'

echo
echo "caller usage:"
if [ -f .github/workflows/security-gates.yml ]; then
  nl -ba .github/workflows/security-gates.yml | sed -n '1,120p'
fi

Repository: Trendyol/stove

Length of output: 209

🏁 Script executed:

#!/bin/bash
set -euo pipefail

caller_file=".github/workflows/security-gates.yml"

echo "caller file:"
if [ -f "$caller_file" ]; then
  awk '{printf "%6d\t%s\n", NR, $0}' "$caller_file" | sed -n '1,120p'
else
  echo "missing $caller_file"
fi

echo
echo "called workflow refs/secrets:"
sha="$(gh api repos/Trendyol/security-actions/commits/master --jq '.sha')"
for f in .github/workflows/*.yml; do
  if [ "$(gh api -XGET "repos/Trendyol/security-actions/contents/$f?ref=$sha" --jq '.type == \"file\"" 2>/dev/null || true)" == "true" ]; then
    content="$(gh api "repos/Trendyol/security-actions/contents/$f?ref=$sha" --jq '.type == "file" and .content' 2>/dev/null || true)"
    if [ "$content" = "true" ]; then
      echo "--- $f (maybe no content) ---"
    else
      echo "--- $f ---"
    fi
  fi
done

echo
echo "called workflow security-gates.yml:"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
  --jq '.content' | awk '{printf "%6d\t%s\n", NR, $0}' | sed -n '1,180p'

echo
echo "called workflow env var usages:"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
  --jq '.content' | java -jar /dev/null 2>/dev/null || awk '
  /secrets\./ || /env:/ || /curl -X POST/ || /GITHUB_EVENT_PATH/ || /POST\/|PUT\/$/ || /X-Slack|Authorization:/ {
    print NR "\t" $0
  }'

echo
echo "github docs excerpt via web page text unavailable here; checking if gh docs command exists"
if command -v gh >/dev/null 2>&1; then
  gh --version
fi

Repository: Trendyol/stove

Length of output: 888

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sha="$(gh api repos/Trendyol/security-actions/commits/master --jq '.sha')"

echo "called workflow:"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
  --jq '.content' | awk '{printf "%6d\t%s\n", NR, $0}' | sed -n '1,180p'

echo
echo "secrets/env/url matches in called workflow:"
gh api "repos/Trendyol/security-actions/contents/.github/workflows/security-gates.yml?ref=$sha" \
  --jq '.content' | awk '
/secrets\./{print NR"\n"$0}
/env:/||/curl -X POST/||/POST\/|PUT\/$/||/SLACK_WEBHOOK_URL/||/APPSEC_ELASTIC/||/APPSEC_CA'

Repository: Trendyol/stove

Length of output: 11236

Pass only the secrets required by the called workflow.

This reusable workflow reads APPSEC_CA, APPSEC_ELASTIC_URL, APPSEC_ELASTIC_USER, APPSEC_ELASTIC_PASS, and SLACK_WEBHOOK_URL. secrets: inherit also makes any other caller secrets available to that repository-owned workflow; drop it if unused, or pass only those required secrets explicitly.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/security-gates.yml at line 24, Replace the broad secrets:
inherit configuration in the reusable workflow invocation with explicit mappings
for APPSEC_CA, APPSEC_ELASTIC_URL, APPSEC_ELASTIC_USER, APPSEC_ELASTIC_PASS, and
SLACK_WEBHOOK_URL, passing only those secrets to the called workflow.

Source: Linters/SAST tools

2 changes: 2 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@

[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Trendyol/stove/badge)](https://scorecard.dev/viewer/?uri=github.com/Trendyol/stove)
<p align="center">
<img src="docs/assets/stove-mark.svg" alt="Stove logo" width="96" height="96"/>
</p>
Expand Down
Loading