williamzujkowski

# Complete GitHub Actions Security Scanning Workflow
# Source: https://williamzujkowski.github.io/posts/2025-10-06-automated-security-scanning-pipeline/
# Purpose: Automated vulnerability scanning with Grype, OSV-Scanner, and Trivy
# Usage: Add to .github/workflows/security-scan.yml in your repository

name: Security Scanning Pipeline

on:
  push:
    branches: [main, develop]

williamzujkowski

# Daily Scheduled Security Scans
# Source: https://williamzujkowski.github.io/posts/2025-10-06-automated-security-scanning-pipeline/
# Purpose: Run security scans on production images daily and compare with baseline
# Usage: Add to .github/workflows/scheduled-scan.yml

name: Daily Security Scan

on:
  schedule:
    - cron: '0 6 * * *'  # Daily at 6 AM UTC

williamzujkowski

# SBOM Generation and Vulnerability Scanning Workflow
# Source: https://williamzujkowski.github.io/posts/2025-10-06-automated-security-scanning-pipeline/
# Purpose: Generate Software Bill of Materials (SBOM) and scan for vulnerabilities
# Usage: Add to .github/workflows/sbom-scan.yml - runs on release

name: SBOM Generation and Scanning

on:
  release:
    types: [published]

williamzujkowski

# Complete GitHub Actions Security Scanning Workflow
# Source: https://williamzujkowski.github.io/posts/2025-10-06-automated-security-scanning-pipeline/
# Purpose: Automated vulnerability scanning with Grype, OSV-Scanner, and Trivy
# Usage: Add to .github/workflows/security-scan.yml in your repository

name: Security Scanning Pipeline

on:
  push:
    branches: [main, develop]

williamzujkowski

# Daily Scheduled Security Scans
# Source: https://williamzujkowski.github.io/posts/2025-10-06-automated-security-scanning-pipeline/
# Purpose: Run security scans on production images daily and compare with baseline
# Usage: Add to .github/workflows/scheduled-scan.yml

name: Daily Security Scan

on:
  schedule:
    - cron: '0 6 * * *'  # Daily at 6 AM UTC

williamzujkowski

# SBOM Generation and Vulnerability Scanning Workflow
# Source: https://williamzujkowski.github.io/posts/2025-10-06-automated-security-scanning-pipeline/
# Purpose: Generate Software Bill of Materials (SBOM) and scan for vulnerabilities
# Usage: Add to .github/workflows/sbom-scan.yml - runs on release

name: SBOM Generation and Scanning

on:
  release:
    types: [published]

williamzujkowski

# Automated Vulnerability Remediation Workflow
# Source: https://williamzujkowski.github.io/posts/2025-10-06-automated-security-scanning-pipeline/
# Purpose: Automatically update dependencies to fix vulnerabilities and create PR
# Usage: Add to .github/workflows/auto-remediate.yml - runs weekly

name: Automated Vulnerability Remediation

on:
  schedule:
    - cron: '0 3 * * 1'  # Weekly on Monday

williamzujkowski

# Grype Vulnerability Scanner Configuration
# Source: https://williamzujkowski.github.io/posts/2025-10-06-automated-security-scanning-pipeline/
# Purpose: Configure Grype scanner with ignore rules and severity thresholds
# Usage: Save as .grype.yaml in project root

# Exclude false positives
ignore:
  - vulnerability: CVE-2023-12345
    reason: "Not applicable - feature not used"
    expiration: 2025-12-31

williamzujkowski

# OSV-Scanner Configuration
# Source: https://williamzujkowski.github.io/posts/2025-10-06-automated-security-scanning-pipeline/
# Purpose: Configure OSV-Scanner for dependency scanning with ignore rules
# Usage: Save as osv-scanner.toml in project root

[ignore]
# Ignore specific vulnerabilities
vulnerabilities = [
  "GHSA-xxxx-yyyy-zzzz"
]

williamzujkowski

# Trivy OPA Policy for Security Scanning
# Source: https://williamzujkowski.github.io/posts/2025-10-06-automated-security-scanning-pipeline/
# Purpose: Define security policies using Open Policy Agent (OPA)
# Usage: Save as policy/security.rego and reference with trivy --policy

package trivy

# Deny images with critical vulnerabilities
deny[msg] {
    input.Vulnerabilities[_].Severity == "CRITICAL"