Add CI security scanning (#14) #37

Merged

james merged 10 commits from 14-ci-security-scanning into main 2026-06-14 00:18:27 +00:00

Conversation 0 Commits 10 Files changed 10 +727 -49

james commented 2026-06-13 15:05:19 +00:00

Owner

Copy link

Closes #14.

Summary

• Three new PR-pipeline jobs in .forgejo/workflows/pr.yml:
  • npm_audit — production deps only (--omit=dev)
  • osv_scan — OSV-Scanner v1.9.2 binary, pinned, against package-lock.json
  • image_scan — Trivy 0.58.1 against a locally-built carol-service:scan image (uses the :act-24.04 runner image because it ships the Docker CLI)
• A single configurable knob: workflow-level SECURITY_SEVERITY_THRESHOLD: high. All three scanners read it through scripts/ci/security-summary.mjs, which normalizes each scanner's severity scale (npm's moderate → medium, OSV's CVSS-score fallback, Trivy's uppercase) into one four-level scale.
• Findings render as a Markdown table on the workflow run page via $GITHUB_STEP_SUMMARY — count by severity, then per-finding rows with package, advisory link, installed/range, fix version. Not buried in raw step logs.
• ADR-0004 records tool choices, the high threshold rationale, and alternatives considered (Snyk, audit-ci, Grype, CodeQL, per-scanner native flags as the gate, warn-only mode).

Bundled: Kysely 0.27.6 → 0.29.2

npm audit against the current lockfile flags Kysely with three high-severity SQL-injection advisories (GHSA-wmrf-hv6w-mr66, GHSA-8cpq-38p9-67gx, GHSA-pv5w-4p9q-p3v2). Without the bump the new gate would block every PR after this one lands. Fix lands here so #14 ships in a coherent state.

Kysely 0.29 moved Migrator and Migration types to a kysely/migration subpath; db/migrator.ts and db/migrations/001_example.ts follow the new import.

Branch-name note

The original branch 19-ci-security-scanning was mis-numbered. This PR is on 14-ci-security-scanning (matches the ticket).

Test plan

• All seven jobs (lint, typecheck, build, test×2, npm_audit, osv_scan, image_scan) go green on this PR
• Workflow run page renders the three security summaries as Markdown tables, each showing 0 findings at/above high on a clean tree
• (Manual follow-up on a throwaway branch) npm install lodash@4.17.20 trips both npm_audit and osv_scan with populated tables; revert
• (Manual) bumping the env to SECURITY_SEVERITY_THRESHOLD: critical retunes all three gates without further edits

🤖 Generated with Claude Code

Closes #14. ## Summary - Three new PR-pipeline jobs in `.forgejo/workflows/pr.yml`: - `npm_audit` — production deps only (`--omit=dev`) - `osv_scan` — OSV-Scanner v1.9.2 binary, pinned, against `package-lock.json` - `image_scan` — Trivy 0.58.1 against a locally-built `carol-service:scan` image (uses the `:act-24.04` runner image because it ships the Docker CLI) - A single configurable knob: workflow-level `SECURITY_SEVERITY_THRESHOLD: high`. All three scanners read it through `scripts/ci/security-summary.mjs`, which normalizes each scanner's severity scale (npm's `moderate` → `medium`, OSV's CVSS-score fallback, Trivy's uppercase) into one four-level scale. - Findings render as a Markdown table on the workflow run page via `$GITHUB_STEP_SUMMARY` — count by severity, then per-finding rows with package, advisory link, installed/range, fix version. Not buried in raw step logs. - ADR-0004 records tool choices, the `high` threshold rationale, and alternatives considered (Snyk, audit-ci, Grype, CodeQL, per-scanner native flags as the gate, warn-only mode). ## Bundled: Kysely 0.27.6 → 0.29.2 `npm audit` against the current lockfile flags Kysely with three high-severity SQL-injection advisories (GHSA-wmrf-hv6w-mr66, GHSA-8cpq-38p9-67gx, GHSA-pv5w-4p9q-p3v2). Without the bump the new gate would block every PR after this one lands. Fix lands here so #14 ships in a coherent state. Kysely 0.29 moved `Migrator` and `Migration` types to a `kysely/migration` subpath; `db/migrator.ts` and `db/migrations/001_example.ts` follow the new import. ## Branch-name note The original branch `19-ci-security-scanning` was mis-numbered. This PR is on `14-ci-security-scanning` (matches the ticket). ## Test plan - [ ] All seven jobs (lint, typecheck, build, test×2, npm_audit, osv_scan, image_scan) go green on this PR - [ ] Workflow run page renders the three security summaries as Markdown tables, each showing 0 findings at/above `high` on a clean tree - [ ] (Manual follow-up on a throwaway branch) `npm install lodash@4.17.20` trips both `npm_audit` and `osv_scan` with populated tables; revert - [ ] (Manual) bumping the env to `SECURITY_SEVERITY_THRESHOLD: critical` retunes all three gates without further edits 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james added 1 commit 2026-06-13 15:05:19 +00:00

Add CI security scanning (#14) ... ef36b5f24e

Adds three security jobs to the PR workflow: npm_audit and osv_scan run
against the production lockfile, image_scan builds the service image and
runs Trivy against it. A single SECURITY_SEVERITY_THRESHOLD env var (set
to `high`) is the gate for all three — each scanner's JSON is normalized
through scripts/ci/security-summary.mjs, which writes a Markdown findings
table to $GITHUB_STEP_SUMMARY and prints qualifying=<n> for the gate.

Bundles a Kysely 0.27.6 → 0.29.2 bump that closes a high-severity SQL-
injection advisory (GHSA-wmrf-hv6w-mr66 et al.) so PRs land green once
the new gate is enforced. Kysely 0.29 moved Migrator/Migration types to
the kysely/migration subpath; the migrator and the example migration
follow the new import.

Tool choices and the `high` threshold are recorded in ADR-0004.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

james referenced this pull request from a commit 2026-06-13 15:49:49 +00:00

Pull CI actions from the local forgejo mirror

james added 1 commit 2026-06-13 15:49:49 +00:00

Pull CI actions from the local forgejo mirror ... 914bfb8e4d

The act_runner couldn't resolve actions/checkout@v4 and actions/setup-node@v4
via data.forgejo.org, breaking every job on PR #37. Switch all uses: to the
local mirror at forge.wynning.tech/actions/* so the runner pulls from a
source we control.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

james added 1 commit 2026-06-13 15:51:58 +00:00

Use full https:// URL for the mirrored action sources ... d35f6b34e6

Without the scheme, act_runner treats the host as a relative path and
fails to resolve the action.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

james added 1 commit 2026-06-13 16:01:30 +00:00

Bump pinned action tags to current releases ... 343147bd4b

Move from @v4 floating to specific tags that the act_runner can resolve
cleanly from the local Forgejo mirror — actions/checkout@v6.0.3 and
actions/setup-node@v6.4.0.

(Restores actions/checkout on the first uses: in each job; the prior edit
duplicated setup-node by mistake.)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

james added 1 commit 2026-06-13 22:56:28 +00:00

Fix scanner install URLs and bump to current stable tags ... 990dede20a

OSV-Scanner: the v1.9.2 asset URL embedded the version in the filename
(404). The actual asset name is just `osv-scanner_linux_amd64` with no
version suffix. Bumping to v2.3.8 (current) at the same time and
switching the CLI to the v2 `scan source` subcommand.

Trivy: v0.58.1 didn't exist as a release (the install.sh fell back to
"latest" but with the requested tag baked into the URL, producing an
error 1). Bumping to v0.71.0 and replacing the install.sh indirection
with a direct tarball fetch — fewer moving parts, the script's behaviour
drifted between tags.

OSV-Scanner v2 surfaces dev-only deps that npm audit hides via
--omit=dev, so the summary helper now reads `dependency_groups` and
suppresses packages whose only group is `dev`. Matches the npm_audit
policy; ADR-0004 updated to record the rationale and the resulting
gap in coverage of the developer-machine threat model.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

james added 1 commit 2026-06-13 22:59:42 +00:00

Renumber ADR-0004 → ADR-0005 ... 600d497da6

#11 (local user auth) is also targeting ADR-0004; renumber this one
out of the way. File renamed via `git mv` to preserve history.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

james added 1 commit 2026-06-13 23:33:17 +00:00

Stop using uses: actions, inline checkout instead ... 9a1d3b3728

act_runner pulls each `uses:` action by `git fetch origin <ref>` with
no shallow option. The Cloudflare-fronted Forgejo mirror at
forge.wynning.tech can't stream the resulting multi-MB packfile reliably
under CF's free-tier limits — index-pack exits 128 mid-stream. Two
attempts at fixing this in-mirror (current tags, pinned tags) both hit
the same failure.

Workaround: drop every `uses:` and inline what they did.
- Container image switches from `ghcr.io/catthehacker/ubuntu:js-24.04`
  to `node:22-slim` for all node-only jobs. The slim image ships Node
  22 directly, so setup-node becomes unnecessary; we apt-install git,
  curl, and ca-certificates per job because slim is bare-bones.
- Checkout is `git init` → `git fetch --depth=1 origin $head_sha` →
  `git checkout -f FETCH_HEAD`. The PR head SHA comes from the event
  payload, so this works for forks and same-repo PRs alike.
- image_scan keeps `:act-24.04` (still needs the Docker CLI it ships).

Trade-offs: lose setup-node's npm cache (every job does a full npm ci);
lose actions/checkout's submodule/lfs handling (we don't use either).

Revert when the mirror moves off CF or act_runner gains a shallow-fetch
option for action resolution. The file's top comment carries that note
so the workaround doesn't ossify.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

james added 1 commit 2026-06-13 23:33:57 +00:00

Revert "Stop using uses: actions, inline checkout instead" ... e45029357d

This reverts commit 9a1d3b3728.

james added 1 commit 2026-06-13 23:34:22 +00:00

Pull actions over the CF-bypassing internal hostname ... 6896ab0737

The public hostname forge.wynning.tech is Cloudflare-fronted, which
truncates the full-history pack act_runner fetches for each `uses:`
action (index-pack exits 128). forge.int.wynning.tech reaches the
same Forgejo instance directly and serves the same repos.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

james added 1 commit 2026-06-13 23:55:29 +00:00

Roll back to default action resolution ... 4cddb18b03

Runner-side networking fix landed out of band; the explicit
forge.int.wynning.tech prefix is no longer needed and the unqualified
`actions/checkout@v6.0.3` / `actions/setup-node@v6.4.0` form lets the
runner resolve actions through its default source again.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

james added 1 commit 2026-06-14 00:06:19 +00:00

Add .trivyignore for unfixable Debian base + bundled Next.js CVEs ... 93829530d5

Trivy's first run flagged 11 findings at/above `high`. None are
actionable today:

- 10 are Debian-bookworm OS packages in node:22-slim with `fix: none`
  upstream (perl-base ×6, zlib1g ×1, ncurses ×3). The vulnerable code
  paths aren't reachable from the running service (no perl invocation,
  no untrusted archive decompression, no TTY/curses).
- 1 is picomatch ≤4.0.3, bundled inside `next/dist/compiled/picomatch`.
  Not in our dep tree; only bumpable via a Next major release. Next
  uses it on developer-defined route patterns, not user input.

Each entry in .trivyignore carries a comment block with the rationale
and a "revisit when" trigger. Trivy invocation now passes
`--ignorefile .trivyignore` explicitly so the allowlist source is
self-evident in the job log (it's also the default path).

ADR-0005 updated: the allowlist mechanism the doc anticipated is now
in place for Trivy. Same pattern will extend to npm_audit / osv_scan
the first time one of them hits a non-actionable finding.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

james referenced this pull request from a commit 2026-06-14 00:15:18 +00:00

Pull CI actions from the local forgejo mirror

james force-pushed 14-ci-security-scanning from 93829530d5 to f6a810106b 2026-06-14 00:15:18 +00:00 Compare

james merged commit aa309e186d into main 2026-06-14 00:18:27 +00:00

james referenced this pull request from a commit 2026-06-14 00:18:27 +00:00

Merge pull request 'Add CI security scanning (#14)' (#37) from 14-ci-security-scanning into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area:auth

Authentication and authorization

  

area:ci

Forgejo Actions, build, test, security, release

  

area:db

Database abstraction, migrations, persistence

  

area:infra

Containerization, deployment, foundational tooling

  

area:native

React Native app (Android + Linux Flatpak)

  

area:pwa

PWA / web frontend

  

area:service

Backend service, API routes, persistence

  

epic

High-level tracker; links several feature tickets

  

feature

A user-facing feature

  

foundation

Foundational work that other tickets build on

No labels

area:auth

area:ci

area:db

area:infra

area:native

area:pwa

area:service

epic

feature

foundation

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

james/carol!37

No description provided.