feat: Add GitHub Actions CI/CD workflow #189
Conversation
Kusari Analysis Results:Caution Flagged Issues Detected While dependency analysis shows no concerning changes, code analysis reveals 11 high-severity security vulnerabilities in GitHub Actions workflows that pose critical risks. The primary concerns are workflow_run triggers across 4 workflows that create attack vectors for malicious code execution, and unpinned GitHub Actions that expose the repository to supply chain attacks. These vulnerabilities could compromise the entire repository and must be remediated before the PR can be safely merged. Specific mitigations have been provided for replacing unsafe triggers and pinning all GitHub Actions to commit hashes. Note View full detailed analysis result for more information on the output and the checks that were run. Required Code MitigationsReplace workflow_run trigger with safer alternatives to prevent potential security exploits
Replace workflow_run trigger with safer alternatives to prevent potential security exploits
Replace workflow_run trigger with safer alternatives to prevent potential security exploits
Replace workflow_run trigger with safer alternatives to prevent potential security exploits
Pin GitHub Action to specific commit hash to prevent supply chain attacks
Pin GitHub Action to specific commit hash to prevent supply chain attacks
Pin GitHub Action to specific commit hash to prevent supply chain attacks
Pin GitHub Action to specific commit hash to prevent supply chain attacks
Pin GitHub Action to specific commit hash to prevent supply chain attacks
Pin GitHub Action to specific commit hash to prevent supply chain attacks
Pin GitHub Action to specific commit hash to prevent supply chain attacks
Found this helpful? Give it a 👍 or 👎 reaction! |
![kusari-inspector[bot]](https://avatars.githubusercontent.com/in/1220830?s=60&v=4){kind=small}
zohayb23
force-pushed
the
feature/add-comprehensive-cicd-workflow
branch
from
f62feac to
479166b
Compare
|
Integration test, security scan, and lint could all be their own workflows. Build and test another. And then build binaries and push images. You can set dependencies between workflows if needed. This one file is a little too big for my liking. Looks good otherwise. |
|
We already have lint and build workflows. That's what I thought. We could use |
- Add ci-cd.yml workflow with automated build, test, and deployment - Implement security scanning with Trivy and Gosec - Add multi-platform binary builds (Linux, macOS, Windows - amd64/arm64) - Add Docker multi-arch builds with GHCR and Docker Hub support - Include integration testing and artifact uploads - Update README with CI/CD information
Security Fixes (Kusari Inspector findings):
- Move permissions from workflow level to individual jobs (least privilege)
- Fix template injection vulnerabilities using environment variables
- Add persist-credentials: false to integration-test checkout
- Add proper permissions to all jobs
Optimizations (ChatGPT suggestions):
- Add id: build to Docker step for attestation digest reference
- Pin action versions: trivy@0.28.0, gosec@v2.21.4 (prevent breaking changes)
- Add concurrency control to cancel old runs on new push
- Add explicit permissions: {} at workflow level for clarity
All 16 high severity Kusari issues resolved.
…dback Based on Jason's feedback: - Split large ci-cd.yml into focused workflows - Use workflow_run to trigger CD/security workflows after build/lint pass - Reuse existing build.yaml and lint.yaml workflows - Verify both build and lint pass before triggering CD workflows New workflows: - security-scan.yml: Security scanning (Trivy + Gosec) - build-binaries.yml: Multi-platform binary builds - docker-push.yml: Docker build and push to GHCR/DockerHub - integration-test.yml: Integration testing after Docker push Dependencies: - security-scan, build-binaries, docker-push: Trigger after build workflow - integration-test: Triggers after docker-push workflow - All workflows verify both build AND lint passed before running Also updates gemara dependency to v0.13.0
zohayb23
force-pushed
the
feature/add-comprehensive-cicd-workflow
branch
from
479166b to
9b70570
Compare
|
Kusari PR Analysis rerun based on - 9b70570 performed at: 2025-11-05T05:35:23Z - link to updated analysis |
- Fix Docker Hub credentials check to use proper step output - Conditionally include Docker Hub image in metadata only when credentials exist - Fix indentation consistency in build-binaries.yml and docker-push.yml - Prevents empty image entries in metadata action when Docker Hub not configured
|
Kusari PR Analysis rerun based on - 26c5d61 performed at: 2025-11-05T06:05:01Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - d9731f9 performed at: 2025-11-05T06:14:19Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - a20de9d performed at: 2025-11-05T07:32:46Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - 89723bf performed at: 2025-11-05T07:37:15Z - link to updated analysis |
zohayb23
force-pushed
the
feature/add-comprehensive-cicd-workflow
branch
from
89723bf to
6fa2a83
Compare
|
Kusari PR Analysis rerun based on - 1680a3e performed at: 2025-11-05T07:50:15Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - 049280e performed at: 2025-11-06T05:05:50Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - 15c6b8b performed at: 2025-11-06T05:25:27Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - 34c989c performed at: 2025-11-06T06:02:14Z - link to updated analysis |
- Update privateer-sdk from v1.10.0 to v1.13.0 to include ToSARIF fixes - Fix template injection vulnerabilities using context.payload instead of template strings - Add repository and branch validation for workflow_run triggers - All security validations ensure workflows only run from same repo and allowed branches
zohayb23
force-pushed
the
feature/add-comprehensive-cicd-workflow
branch
from
34c989c to
bfb7e8c
Compare
|
Kusari PR Analysis rerun based on - bfb7e8c performed at: 2025-11-06T06:20:42Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - 9378d4b performed at: 2025-11-10T23:21:14Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - d0da0b6 performed at: 2025-11-10T23:22:57Z - link to updated analysis |
2 participants
Adds GitHub Actions CI/CD workflow with automated build, test, security scanning, and multi-platform Docker image publishing.
Workflow runs automatically on push/PR to
mainordevelop.