Skip to content

Commit 95f05b0

Browse files
mastermanas805claude
mastermanas805
and
claude
authored
ci: Tier 1 OSS security scanners (CodeQL + Dependabot + govulncheck + OSV-Scanner) (#12)
* ci: Tier 1 OSS security scanners Adds GitHub-native + free OSS vulnerability scanners. All tools are 100% free for public repos — no API keys, no metered usage. - CodeQL with security-extended query suite - Dependabot for gomod + github-actions - govulncheck (Go reachability-filtered CVE scan) - OSV-Scanner (cross-ecosystem CVE scan) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci: scanner workflows clone sibling common + proto repos The Tier 1 CodeQL + govulncheck workflows failed on PR #12 because provisioner uses `replace instant.dev/common => ../common` and `replace instant.dev/proto => ../proto` in go.mod. Fix: each workflow now checks out provisioner into ./provisioner, plus clones public sibling repos InstaNode-dev/common and InstaNode-dev/proto. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(go): bump toolchain to 1.25.10 — fixes reachable stdlib CVEs govulncheck on PR #12 flagged Go-stdlib vulnerabilities reachable from production code paths. All fixed in Go 1.25.9–1.25.10. Also merges any in-flight master commits onto the scanner-install branch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Manas Srivastava <[email protected]> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent a0d80b0 commit 95f05b0

5 files changed

Lines changed: 142 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: gomod
4+
directory: "/"
5+
schedule:
6+
interval: weekly
7+
day: monday
8+
time: "06:00"
9+
timezone: Etc/UTC
10+
open-pull-requests-limit: 5
11+
groups:
12+
gomod-security:
13+
applies-to: security-updates
14+
patterns:
15+
- "*"
16+
gomod-minor-patch:
17+
applies-to: version-updates
18+
update-types:
19+
- minor
20+
- patch
21+
22+
- package-ecosystem: github-actions
23+
directory: "/"
24+
schedule:
25+
interval: weekly
26+
day: monday
27+
open-pull-requests-limit: 3
28+
groups:
29+
actions:
30+
patterns:
31+
- "*"

‎.github/workflows/codeql.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches: [master, main]
6+
pull_request:
7+
branches: [master, main]
8+
schedule:
9+
- cron: '17 6 * * 1'
10+
11+
permissions:
12+
actions: read
13+
contents: read
14+
security-events: write
15+
16+
jobs:
17+
analyze:
18+
name: Analyze (Go)
19+
runs-on: ubuntu-latest
20+
timeout-minutes: 30
21+
steps:
22+
- name: Checkout this repo
23+
uses: actions/checkout@v4
24+
with:
25+
path: provisioner
26+
- name: Checkout sibling InstaNode-dev/common
27+
uses: actions/checkout@v4
28+
with:
29+
repository: InstaNode-dev/common
30+
path: common
31+
- name: Checkout sibling InstaNode-dev/proto
32+
uses: actions/checkout@v4
33+
with:
34+
repository: InstaNode-dev/proto
35+
path: proto
36+
- uses: actions/setup-go@v5
37+
with:
38+
go-version-file: provisioner/go.mod
39+
- uses: github/codeql-action/init@v3
40+
with:
41+
languages: go
42+
queries: security-extended
43+
- name: Build
44+
working-directory: provisioner
45+
run: go build ./...
46+
- uses: github/codeql-action/analyze@v3
47+
with:
48+
category: "/language:go"

‎.github/workflows/govulncheck.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: govulncheck
2+
3+
on:
4+
push:
5+
branches: [master, main]
6+
pull_request:
7+
branches: [master, main]
8+
schedule:
9+
- cron: '0 6 * * *'
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
govulncheck:
16+
runs-on: ubuntu-latest
17+
timeout-minutes: 15
18+
steps:
19+
- name: Checkout this repo
20+
uses: actions/checkout@v4
21+
with:
22+
path: provisioner
23+
- name: Checkout sibling InstaNode-dev/common
24+
uses: actions/checkout@v4
25+
with:
26+
repository: InstaNode-dev/common
27+
path: common
28+
- name: Checkout sibling InstaNode-dev/proto
29+
uses: actions/checkout@v4
30+
with:
31+
repository: InstaNode-dev/proto
32+
path: proto
33+
- uses: actions/setup-go@v5
34+
with:
35+
go-version-file: provisioner/go.mod
36+
check-latest: true
37+
- run: go install golang.org/x/vuln/cmd/govulncheck@latest
38+
- working-directory: provisioner
39+
run: govulncheck ./...

‎.github/workflows/osv-scanner.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: OSV-Scanner
2+
3+
on:
4+
push:
5+
branches: [master, main]
6+
pull_request:
7+
branches: [master, main]
8+
schedule:
9+
- cron: '0 6 * * *'
10+
11+
permissions:
12+
actions: read
13+
contents: read
14+
security-events: write
15+
16+
jobs:
17+
scan:
18+
uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.0.1
19+
permissions:
20+
actions: read
21+
contents: read
22+
security-events: write

‎go.mod‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ module instant.dev/provisioner
22

33
go 1.25.0
44

5+
toolchain go1.25.10
6+
57
require (
68
github.com/google/uuid v1.6.0
79
github.com/jackc/pgx/v5 v5.6.0

0 commit comments

Comments
 (0)