Docs: add security scanning guides and Makefile targets#3525
Docs: add security scanning guides and Makefile targets#3525arkid15r merged 18 commits intoOWASP:mainfrom
Conversation
github-actions
bot
added
docs
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughAdds hierarchical security-scan targets (code and image) to Makefiles, integrates Semgrep and Trivy scans in CI, documents local security-scan usage and suppression in CONTRIBUTING.md, renames backend/frontend image scan targets, and adds "aquasec" to the cspell dictionary. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@CONTRIBUTING.md`:
- Around line 413-423: Replace the bolded section titles "**Filesystem Scan**"
and "**Repository Scan**" with proper Markdown headings (e.g., "### Filesystem
Scan" and "### Repository Scan" or the heading level that matches adjacent
sections) so they are parsed as headings instead of bold text and MD036 is
satisfied; update the surrounding code blocks and lists to remain under those
headings and re-run markdownlint to confirm the warning is resolved.
🧹 Nitpick comments (1)
Makefile (1)
85-91: Pin the Trivy Docker image tag for consistency with local scans.The unpinned
aquasec/trivyimage in these targets can pull different versions over time, causing scan results to drift. Whiletrivy.yamlalready standardizes severity filtering and checks, pinning the image tag ensures reproducible behavior across runs and environments. Consider pinning to a specific stable release.🔧 Suggested update
+TRIVY_IMAGE ?= aquasec/trivy:0.50.1 + security-scan-deps: `@echo` "Running Trivy Filesystem Scan..." - `@docker` run --rm -v "$(PWD):/src" aquasec/trivy fs /src + `@docker` run --rm -v "$(PWD):/src" $(TRIVY_IMAGE) fs /src security-scan-repo: `@echo` "Running Trivy Repository Scan..." - `@docker` run --rm -v "$(PWD):/src" aquasec/trivy repo /src + `@docker` run --rm -v "$(PWD):/src" $(TRIVY_IMAGE) repo /src
SpruhaCK
changed the title
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@CONTRIBUTING.md`:
- Around line 409-427: Update the "Running Security Scan" section in
CONTRIBUTING.md (the paragraph describing make security-scan) to explicitly
state that semgrep-security-report.txt is written to the project root; locate
the block that lists the command and the bullet points and append or change the
sentence to read something like "Generates a persistent
semgrep-security-report.txt file in the project root" so contributors know the
exact file location when reviewing findings from the make security-scan command.
- Around line 429-451: Update the "Repository Scan" description to accurately
state that the command (triggered by make security-scan-repo which runs trivy
repo /src) scans the current repository snapshot (the checked-out tree at HEAD)
for secrets, misconfigurations and vulnerabilities rather than scanning the full
Git commit history; replace any wording that says "scan the Git history" with
phrasing like "scan the repository snapshot (checked-out tree at HEAD) for
secrets and configurations" and keep the note that it identifies critical/high
vulnerabilities that block CI/CD.
hassaansaleem28
left a comment
hassaansaleem28
left a comment
There was a problem hiding this comment.
I verified that scan-images correctly delegates to the sub-Makefiles, so the local plumbing works.
Currently, run-ci-cd.yaml (Lines 968-989) uses hardcoded inline configuration for Trivy.
Ig to fully standardize local and CI workflows, we should update the CI to run make scan-images. This ensures that our CI always matches the local development environment and removes duplicate configuration.
Hi @hassaansaleem28 , thanks for the review! I agree, moving the CI logic into these Makefile targets is the best way to keep our local and cloud environments consistent. Since the current scope of this PR is focused on the local plumbing and documentation for #3494 and trivy, I’d be happy to coordinate that CI refactor with you as a follow-up once these changes are merged! |
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3525 +/- ##
=======================================
Coverage 85.49% 85.49%
=======================================
Files 462 462
Lines 14260 14260
Branches 1900 1900
=======================================
Hits 12191 12191
Misses 1689 1689
Partials 380 380
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
3 participants
Resolves #3494
This PR updates CONTRIBUTING.md to include comprehensive documentation for the project's security scanning workflows, specifically covering Semgrep and Trivy and introduces new Makefile targets to streamline local security scanning.
Changes
Added "Running Dependency Scans" Section:
Included a new section for Trivy, utilizing the newly created make commands to simplify the user experience.
Added "Running Security Scans" Section:
Documented the make security-scan command for local Semgrep analysis and included instructions for reviewing the generated semgrep-security-report.txt.
Makefile Automation
Introduced security-scan-deps and security-scan-repo targets to standardize local Trivy scans alongside existing security tools.
Note on Section Ordering: I have placed the Security and Dependency scan sections before the e2e and fuzz test sections to reflect the logical order of a standard CI/CD pipeline i.e. Static Analysis -> Dependency Scanning -> Functional Testing. The content of the e2e and fuzz sections remains unchanged.
Checklist
make check-testlocally: only frontend tests failed in this branch as well as in main branch