Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security: fine tune security-scanner #20465

Merged
merged 1 commit into from
Sep 18, 2024
Merged

security: fine tune security-scanner #20465

merged 1 commit into from
Sep 18, 2024

Conversation

dduzgun-security
Copy link
Contributor

This PR updates the security scanner configuration for better accuracy and coverage.

@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

6 similar comments
@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

tgross
tgross reviewed Apr 25, 2024
View reviewed changes
.github/dependabot.yml Outdated Show resolved Hide resolved
tgross
tgross requested changes Apr 26, 2024
View reviewed changes
Copy link
Member

@tgross tgross left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dduzgun-security I've left a few comments on this which we should resolve. Take the PR out of draft when you've addressed those and are ready for a re-review.

I had a concern that this was going to add significantly to the CI times, but it looks like from this run that these are <2min, which is fine when they run in parallel.

.github/workflows/security-scan.yml Show resolved Hide resolved
.github/workflows/security-scan.yml Show resolved Hide resolved
.github/workflows/security-scan.yml Outdated Show resolved Hide resolved
.github/workflows/security-scan.yml Outdated Show resolved Hide resolved
.release/security-scan.hcl Show resolved Hide resolved
.release/security-scan.hcl Outdated Show resolved Hide resolved
scan.hcl Outdated Show resolved Hide resolved
.github/dependabot.yml Show resolved Hide resolved
scan.hcl Outdated Show resolved Hide resolved
@tgross tgross added the stage/needs-rebase This PR needs to be rebased on main before it can be backported to pick up new BPA workflows label May 17, 2024
@dduzgun-security dduzgun-security marked this pull request as ready for review July 3, 2024 20:59
@dduzgun-security dduzgun-security requested review from a team as code owners July 3, 2024 20:59
tgross
tgross reviewed Jul 8, 2024
View reviewed changes
Copy link
Member

@tgross tgross left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM once the remaining two comments are resolved or dismissed.

scan.hcl Outdated Show resolved Hide resolved
@dduzgun-security dduzgun-security self-assigned this Aug 26, 2024
tgross
tgross reviewed Sep 17, 2024
View reviewed changes
Copy link
Member

@tgross tgross left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good... I've left a few comments/questions.

.github/workflows/security-scan.yml Outdated Show resolved Hide resolved
.github/workflows/security-scan.yml Show resolved Hide resolved
.github/workflows/security-scan.yml Outdated Show resolved Hide resolved
.github/workflows/security-scan.yml Show resolved Hide resolved
github-advanced-security[bot]
github-advanced-security bot found potential problems Sep 17, 2024
View reviewed changes
.github/workflows/security-scan.yml Fixed Show resolved Hide resolved
tgross
tgross approved these changes Sep 18, 2024
View reviewed changes
Copy link
Member

@tgross tgross left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dduzgun-security dduzgun-security added backport/ent/1.6.x+ent Changes are backported to 1.6.x+ent backport/ent/1.7.x+ent Changes are backported to 1.7.x+ent backport/ent/1.8.x+ent Changes are backported to 1.8.x+ent backport/1.8.x backport to 1.8.x release line labels Sep 18, 2024
@dduzgun-security
security: fine tune security-scanner to reduce false-positives
fa2fb00 
Resolve scan job runner

Resolve linting alerts

adding EOF on files

adding EOF on gitignore too

add hclfmt and bump action versions

update scan.hcl comments

Co-authored-by: Tim Gross <tgross@hashicorp.com>

fix typo

move scan.hcl file and paths-ignore for scans

change action runner

use org secret to checkout

typo

change runner

use hashicorp/setup-golang@v3

Co-authored-by: Tim Gross <tgross@hashicorp.com>

pin the github action sha
@dduzgun-security dduzgun-security removed the stage/needs-rebase This PR needs to be rebased on main before it can be backported to pick up new BPA workflows label Sep 18, 2024
@dduzgun-security dduzgun-security merged commit 52f0b40 into main Sep 18, 2024
28 checks passed
@dduzgun-security dduzgun-security deleted the security/scanner-enhancement branch September 18, 2024 20:55
@hc-github-team-nomad-core hc-github-team-nomad-core mentioned this pull request Sep 18, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tgross tgross tgross approved these changes

Assignees

@dduzgun-security dduzgun-security

Labels
backport/ent/1.6.x+ent Changes are backported to 1.6.x+ent backport/ent/1.7.x+ent Changes are backported to 1.7.x+ent backport/ent/1.8.x+ent Changes are backported to 1.8.x+ent backport/1.8.x backport to 1.8.x release line theme/ci theme/security
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@dduzgun-security @tgross