From 5664a5eef5372c54de5f2d69d9dd3d1e483ba41f Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Thu, 3 Sep 2026 11:10:31 +0000
Subject: [PATCH] ci: scan for secrets and insecure patterns on every push and
 pull request

devdb has no CI other than the release build, so nothing currently reads
the tree for a credential committed by accident or an insecure pattern
in the container plumbing.

Adds a ThreatCrush scan that gates on critical and high, and publishes
SARIF to the Security tab on push and on the weekly schedule. Pull
requests are gated by the exit code alone, because a pull request from
a fork gets a read-only token and the upload would fail for reasons
unrelated to the code.

The scanner version is pinned rather than floating: a tool that updates
itself in CI is a third party with write access to the build.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017CnhqMwFo6ceywCRLdU2EG
---
 .github/workflows/security.yml | 46 ++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/security.yml

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..1b45afe
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,46 @@
+name: Security
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    # Rules change more often than this repository does, so a weekly run
+    # catches a new rule against unchanged code.
+    - cron: '0 6 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: ThreatCrush
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+
+      # Pinned rather than floating: a scanner that updates itself in CI is a
+      # third party with write access to the build.
+      - name: Scan
+        run: >
+          npx --yes @profullstack/threatcrush@0.11.9 scan .
+          --format sarif
+          --output threatcrush.sarif
+          --fail-on critical,high
+
+      # Only on push and schedule. A pull request from a fork gets a read-only
+      # token, so uploading there would fail for reasons unrelated to the code;
+      # the --fail-on gate above is what reports on a pull request.
+      - name: Upload SARIF
+        if: always() && github.event_name != 'pull_request'
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: threatcrush.sarif
+          category: threatcrush