Skip to content

Commit 47b4b82

Browse files
devatsecureclaude
devatsecure
and
claude
committed
feat: Add full 6-phase pipeline mode to GitHub Action
- Add pipeline-mode input (fast|full, default: fast) to action.yml - Add full pipeline step with hybrid_analyzer.py when mode=full - Fix shell injection: use env vars instead of inputs in run blocks - Add .github/workflows/full-pipeline.yml reusable workflow - Support DAST, sandbox, fuzzing, runtime security, AI provider, cost limit inputs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent d8f574d commit 47b4b82

2 files changed

Lines changed: 521 additions & 26 deletions

File tree

‎.github/workflows/full-pipeline.yml‎

Lines changed: 207 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,207 @@
1+
name: Full Security Pipeline
2+
3+
# Reusable workflow that runs the full 6-phase hybrid security pipeline.
4+
# Uses hybrid_analyzer.py with Semgrep + Trivy + Checkov + TruffleHog + AI enrichment.
5+
#
6+
# Usage from another workflow:
7+
# jobs:
8+
# security:
9+
# uses: devatsecure/Argus-Security/.github/workflows/full-pipeline.yml@main
10+
# secrets:
11+
# anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
12+
13+
on:
14+
workflow_call:
15+
inputs:
16+
project-path:
17+
description: 'Path to the project to scan'
18+
required: false
19+
type: string
20+
default: '.'
21+
severity-filter:
22+
description: 'Comma-separated severity levels to report (e.g., critical,high,medium)'
23+
required: false
24+
type: string
25+
default: ''
26+
enable-dast:
27+
description: 'Enable DAST scanning (requires dast-target-url)'
28+
required: false
29+
type: boolean
30+
default: false
31+
dast-target-url:
32+
description: 'Target URL for DAST scanning'
33+
required: false
34+
type: string
35+
default: ''
36+
enable-sandbox:
37+
description: 'Enable Docker sandbox validation (Phase 4)'
38+
required: false
39+
type: boolean
40+
default: false
41+
enable-proof-by-exploitation:
42+
description: 'Enable LLM-powered PoC exploit generation + sandbox validation'
43+
required: false
44+
type: boolean
45+
default: false
46+
enable-fuzzing:
47+
description: 'Enable AI-guided fuzzing'
48+
required: false
49+
type: boolean
50+
default: false
51+
enable-runtime-security:
52+
description: 'Enable container runtime security monitoring'
53+
required: false
54+
type: boolean
55+
default: false
56+
fail-on-blockers:
57+
description: 'Fail if critical/high findings are found'
58+
required: false
59+
type: boolean
60+
default: true
61+
ai-provider:
62+
description: 'AI provider (anthropic, openai, ollama, auto)'
63+
required: false
64+
type: string
65+
default: 'auto'
66+
cost-limit:
67+
description: 'Max cost in USD per run'
68+
required: false
69+
type: string
70+
default: '5.0'
71+
secrets:
72+
anthropic-api-key:
73+
description: 'Anthropic API key for Claude AI analysis'
74+
required: false
75+
openai-api-key:
76+
description: 'OpenAI API key for GPT-4 analysis'
77+
required: false
78+
outputs:
79+
blockers-found:
80+
description: 'Number of critical/high findings'
81+
value: ${{ jobs.full-pipeline.outputs.blockers }}
82+
total-findings:
83+
description: 'Total number of findings'
84+
value: ${{ jobs.full-pipeline.outputs.total-findings }}
85+
scanners-used:
86+
description: 'Comma-separated list of scanners that ran'
87+
value: ${{ jobs.full-pipeline.outputs.scanners-used }}
88+
89+
# Also allow direct invocation for testing
90+
workflow_dispatch:
91+
inputs:
92+
severity-filter:
93+
description: 'Severity levels to report'
94+
required: false
95+
default: ''
96+
enable-dast:
97+
description: 'Enable DAST scanning'
98+
required: false
99+
type: boolean
100+
default: false
101+
enable-sandbox:
102+
description: 'Enable sandbox validation'
103+
required: false
104+
type: boolean
105+
default: false
106+
fail-on-blockers:
107+
description: 'Fail on critical/high findings'
108+
required: false
109+
type: boolean
110+
default: true
111+
112+
permissions:
113+
contents: read
114+
security-events: write
115+
pull-requests: write
116+
issues: write
117+
118+
concurrency:
119+
group: full-pipeline-${{ github.ref }}
120+
cancel-in-progress: false
121+
122+
jobs:
123+
full-pipeline:
124+
name: Full 6-Phase Security Pipeline
125+
runs-on: ubuntu-latest
126+
timeout-minutes: 45
127+
outputs:
128+
blockers: ${{ steps.argus.outputs.blockers-found }}
129+
total-findings: ${{ steps.argus.outputs.total-findings }}
130+
scanners-used: ${{ steps.argus.outputs.scanners-used }}
131+
132+
steps:
133+
- name: Checkout repository
134+
uses: actions/checkout@v4
135+
with:
136+
fetch-depth: 0
137+
138+
- name: Setup Python
139+
uses: actions/setup-python@v5
140+
with:
141+
python-version: '3.11'
142+
cache: 'pip'
143+
144+
- name: Run Argus Full Pipeline
145+
id: argus
146+
uses: devatsecure/Argus-Security@main
147+
with:
148+
# Select full pipeline mode (hybrid_analyzer.py)
149+
pipeline-mode: 'full'
150+
151+
# AI Configuration
152+
ai-provider: ${{ inputs.ai-provider || 'auto' }}
153+
anthropic-api-key: ${{ secrets.anthropic-api-key || secrets.ANTHROPIC_API_KEY }}
154+
openai-api-key: ${{ secrets.openai-api-key || secrets.OPENAI_API_KEY }}
155+
156+
# Project Configuration
157+
project-path: ${{ inputs.project-path || '.' }}
158+
159+
# Scanner Features
160+
semgrep-enabled: 'true'
161+
enable-dast: ${{ inputs.enable-dast && 'true' || 'false' }}
162+
dast-target-url: ${{ inputs.dast-target-url || '' }}
163+
enable-sandbox: ${{ inputs.enable-sandbox && 'true' || 'false' }}
164+
enable-proof-by-exploitation: ${{ inputs.enable-proof-by-exploitation && 'true' || 'false' }}
165+
enable-fuzzing: ${{ inputs.enable-fuzzing && 'true' || 'false' }}
166+
enable-runtime-security: ${{ inputs.enable-runtime-security && 'true' || 'false' }}
167+
168+
# Enrichment Features (enabled by default in full mode)
169+
enable-multi-agent: 'true'
170+
enable-spontaneous-discovery: 'true'
171+
enable-iris: 'true'
172+
enable-threat-intel: 'true'
173+
enable-remediation: 'true'
174+
enable-supply-chain: 'true'
175+
enable-regression-testing: 'true'
176+
177+
# Reporting
178+
severity-filter: ${{ inputs.severity-filter || '' }}
179+
upload-reports: 'true'
180+
comment-on-pr: 'true'
181+
fail-on-blockers: ${{ inputs.fail-on-blockers && 'true' || 'false' }}
182+
183+
# Cost Controls
184+
cost-limit: ${{ inputs.cost-limit || '5.0' }}
185+
186+
- name: Upload SARIF to Security Tab
187+
if: always() && steps.argus.outputs.sarif-path != ''
188+
continue-on-error: true
189+
uses: github/codeql-action/upload-sarif@b5ebac6f4c00c8ccddb7cdcd45fdb248329f808a # v3
190+
with:
191+
sarif_file: ${{ steps.argus.outputs.sarif-path }}
192+
category: argus-full-pipeline
193+
194+
- name: Pipeline Summary
195+
if: always()
196+
run: |
197+
echo "## Full Security Pipeline Results" >> $GITHUB_STEP_SUMMARY
198+
echo "" >> $GITHUB_STEP_SUMMARY
199+
echo "**Pipeline Mode**: full (hybrid_analyzer.py)" >> $GITHUB_STEP_SUMMARY
200+
echo "**Blockers (critical+high)**: ${{ steps.argus.outputs.blockers-found }}" >> $GITHUB_STEP_SUMMARY
201+
echo "**Suggestions (medium+low)**: ${{ steps.argus.outputs.suggestions-found }}" >> $GITHUB_STEP_SUMMARY
202+
echo "**Total Findings**: ${{ steps.argus.outputs.total-findings }}" >> $GITHUB_STEP_SUMMARY
203+
echo "**Scanners Used**: ${{ steps.argus.outputs.scanners-used }}" >> $GITHUB_STEP_SUMMARY
204+
echo "**Duration**: ${{ steps.argus.outputs.duration-seconds }}s" >> $GITHUB_STEP_SUMMARY
205+
echo "**Cost**: \$${{ steps.argus.outputs.cost-estimate }}" >> $GITHUB_STEP_SUMMARY
206+
echo "" >> $GITHUB_STEP_SUMMARY
207+
echo "[View Security Tab](https://github.com/${{ github.repository }}/security/code-scanning)" >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)