From 0ab18321c53b23cfbe444171d920cd310c31f47d Mon Sep 17 00:00:00 2001 From: abrichr Date: Mon, 20 Jul 2026 10:51:07 -0400 Subject: [PATCH] chore: add security CI (CodeQL, gitleaks, dependency-review, Dependabot) Adds CodeQL SAST, gitleaks secret scanning, dependency review, Dependabot, and a vulnerability-disclosure policy as part of SOC 2 readiness. Additive and non-breaking. Co-Authored-By: Claude Fable 5 --- .github/CODEOWNERS | 2 ++ .github/dependabot.yml | 17 ++++++++++++ .github/workflows/codeql.yml | 37 +++++++++++++++++++++++++ .github/workflows/dependency-review.yml | 21 ++++++++++++++ .github/workflows/secret-scan.yml | 32 +++++++++++++++++++++ SECURITY.md | 35 +++++++++++++++++++++++ 6 files changed, 144 insertions(+) create mode 100644 .github/CODEOWNERS create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/dependency-review.yml create mode 100644 .github/workflows/secret-scan.yml create mode 100644 SECURITY.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..d2c28ca --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,2 @@ +# Default code owners. Enforced via branch protection (required review). +* @abrichr diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..c19199c --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,17 @@ +# SOC 2: automated dependency updates (OA-C-23). +version: 2 +updates: + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + labels: + - "dependencies" + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + labels: + - "dependencies" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..499c72c --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,37 @@ +name: CodeQL + +# SOC 2: SAST (OA-C-24). Static analysis on push/PR to main + weekly. +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: "23 5 * * 1" + +permissions: + contents: read + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + permissions: + security-events: write + actions: read + contents: read + strategy: + fail-fast: false + matrix: + language: ["python"] + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - name: Initialize CodeQL + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + with: + languages: ${{ matrix.language }} + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + with: + category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..f98e230 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,21 @@ +name: Dependency Review + +# SOC 2: dependency-review (OA-C-24). Flags vulnerable/denied deps on PRs. +on: + pull_request: + branches: [main] + +permissions: + contents: read + +jobs: + dependency-review: + name: dependency-review + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - name: Dependency Review + uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 + with: + fail-on-severity: high diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml new file mode 100644 index 0000000..4552c6e --- /dev/null +++ b/.github/workflows/secret-scan.yml @@ -0,0 +1,32 @@ +name: Secret Scan + +# SOC 2: secret scanning (OA-C-24). Uses the free, MIT-licensed gitleaks CLI. +# NOTE: the gitleaks *Action* now requires a paid GITLEAKS_LICENSE for +# organization-owned repos (even public ones); the gitleaks CLI does not, so we +# invoke it directly and pin the version. Scans full git history on PRs + main. +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +jobs: + gitleaks: + name: gitleaks + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + fetch-depth: 0 + - name: Install gitleaks + env: + GITLEAKS_VERSION: 8.30.1 + run: | + curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ + | tar -xz -C /usr/local/bin gitleaks + gitleaks version + - name: Scan git history for secrets + run: gitleaks git . --redact --no-banner diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..69b270f --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,35 @@ +# Security Policy + +## Reporting a Vulnerability + +We take the security of OpenAdapt seriously. If you believe you have found a +security vulnerability in this repository, please report it **privately** — do +**not** open a public issue, discussion, or pull request that describes it. + +**Preferred:** use GitHub's private vulnerability reporting. Go to the +repository's **Security** tab and click **Report a vulnerability**. This opens a +private advisory visible only to the maintainers. + +**Alternative:** email **hello@openadapt.ai** with the details. + +Please include, where possible: + +- A description of the vulnerability and its potential impact +- Steps to reproduce (a proof-of-concept if you have one) +- Affected version(s), commit, endpoint, or configuration +- Any suggested remediation + +## Our commitment + +- We will **acknowledge** your report within **5 business days**. +- We will provide an estimated timeline for a fix and keep you updated on + progress. +- We will credit reporters who wish to be acknowledged once a fix has shipped. +- Please give us a reasonable opportunity to remediate before any public + disclosure. + +## Supported versions + +Security fixes are applied to the latest released version on the `main` branch. + +Thank you for helping keep OpenAdapt and its users safe.