From 033eec92195fb08105c28d8ec536bb2caf39b231 Mon Sep 17 00:00:00 2001 From: navigator Date: Wed, 7 Oct 2026 17:57:44 +0000 Subject: [PATCH] ci: security scanning, with the findings read and justified Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to main and by hand. Not a required check. The handbook carries real scripts (key generation and rotation, organization setup, brand export). A scan of main finds nothing for bandit or semgrep and one shellcheck warning (SC2034, an unused variable in a provisioning script), justified in .github/security-baseline. gitleaks flags docs/build-host.md quoting the fingerprint of the public TurnKey signing key, ignored by fingerprint in .github/.gitleaksignore. --- .github/.gitleaksignore | 3 +++ .github/security-baseline | 3 +++ .github/workflows/security.yml | 19 +++++++++++++++++++ 3 files changed, 25 insertions(+) create mode 100644 .github/.gitleaksignore create mode 100644 .github/security-baseline create mode 100644 .github/workflows/security.yml diff --git a/.github/.gitleaksignore b/.github/.gitleaksignore new file mode 100644 index 0000000..c36d77f --- /dev/null +++ b/.github/.gitleaksignore @@ -0,0 +1,3 @@ +# gitleaks false positives, by fingerprint. Each was read; none is a secret. +# docs/build-host.md: quotes the fingerprint of the public TurnKey signing key. +a4b120acec491eae56859d64413a55ddb566e253:docs/build-host.md:generic-api-key:213 diff --git a/.github/security-baseline b/.github/security-baseline new file mode 100644 index 0000000..57d15d4 --- /dev/null +++ b/.github/security-baseline @@ -0,0 +1,3 @@ +# Security scan baseline (keel-linux/.github, security-scan.yml): findings +# that were read and are not a risk, one per line, the fingerprint and why. +shellcheck:SC2034:docs/infra/keel-provision.pending:929ba114f93a shell lint, not a security risk: a variable read by a sourcing script or left unused diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..6623d98 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,19 @@ +# Security scanning (keel-linux/.github, profile/WORKFLOWS.md "Security +# scanning"): gitleaks, bandit, semgrep and shellcheck on GitHub-hosted +# runners, no secrets. Findings that are not a risk are listed, each with its +# justification, in .github/security-baseline; gitleaks fixtures, if any, in +# .github/gitleaks.toml. +name: security +on: + pull_request: + push: + branches: [main] + workflow_dispatch: +permissions: + contents: read +jobs: + security: + uses: keel-linux/.github/.github/workflows/security-scan.yml@main + permissions: + contents: read + security-events: write