ci(security): SAST, secret and SCA gates

.github/workflows/docker.yml

@@ -179,6 +179,83 @@ jobs:
         run: |
           echo '- `${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.prepare.outputs.build_tag }}`' >> "$GITHUB_STEP_SUMMARY"
 
+  # ─── Image CVE scan ────────────────────────────────────────────────────────
+  # Scans the manifest that was just pushed — the only place where base-image
+  # (nginx:1.27-alpine) and OS-package CVEs are visible. The repo-level pass
+  # (trivy.yml) sees the lock file and Dockerfile, never the shipped layers.
+  #
+  # Report-only for now (`--exit-code 0`): findings go to "Security -> Code
+  # scanning" and the job log, and promotion proceeds. To bar a vulnerable
+  # image from promotion — the policy target — set `--exit-code 1` here and add
+  # `trivy-image` to `dispatch-umbrella`'s `needs`.
+  #
+  # Scoped to main: the promotion path this gate is meant to guard. Branch
+  # dispatches now push a tagged `.<branch>` image too (insight#1994) but never
+  # reach the umbrella, so they are left unscanned to keep dispatch cheap —
+  # drop the `github.ref` half of the condition below to cover them as well.
+  trivy-image:
+    name: Trivy image scan (report-only)
+    needs: merge
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read # checkout (.trivyignore waivers)
+      packages: read # pull the image under scan from GHCR
+      security-events: write # upload SARIF to Code Scanning
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Trivy image scan (CRITICAL/HIGH)
+        # Trivy pulls straight from the registry (TRIVY_USERNAME/TRIVY_PASSWORD) rather than
+        # via a mounted docker socket, so no daemon and no local `docker pull` is needed.
+        # `--ignore-unfixed` keeps the output to what a base-image bump can actually fix.
+        # A multi-arch manifest resolves to the runner's platform (linux/amd64); the arm64
+        # leg shares the same base image and package set, so one pass is representative.
+        env:
+          TRIVY_IMAGE: aquasec/trivy:0.72.0@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f
+          IMAGE_REF: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.merge.outputs.build_tag }}
+          TRIVY_USERNAME: ${{ github.actor }}
+          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          echo "Scanning ${IMAGE_REF}"
+          # Two passes over the same warm DB cache: a readable table in the log, SARIF for
+          # Code Scanning.
+          docker run --rm \
+            -v /tmp/trivy-cache:/root/.cache \
+            -e TRIVY_USERNAME -e TRIVY_PASSWORD \
+            "$TRIVY_IMAGE" image \
+              --severity CRITICAL,HIGH \
+              --pkg-types os,library \
+              --ignore-unfixed \
+              --exit-code 0 \
+              --no-progress \
+              --format table \
+              "$IMAGE_REF"
+          docker run --rm \
+            -v "${{ github.workspace }}:/work" \
+            -v /tmp/trivy-cache:/root/.cache \
+            -e TRIVY_USERNAME -e TRIVY_PASSWORD \
+            "$TRIVY_IMAGE" image \
+              --severity CRITICAL,HIGH \
+              --pkg-types os,library \
+              --ignore-unfixed \
+              --exit-code 0 \
+              --no-progress \
+              --format sarif --output /work/trivy-image.sarif \
+              "$IMAGE_REF"
+
+      - name: Upload SARIF to GitHub Code Scanning
+        if: always()
+        uses: github/codeql-action/upload-sarif@fb0994ef1c058010acf1efccff928b0a83b1ed54 # v4.32.6
+        with:
+          sarif_file: trivy-image.sarif
+          category: trivy-image
+
   # ─── Umbrella chart dispatch ───────────────────────────────────────────────
   # After a successful main-branch image build, trigger the umbrella chart
   # workflow in constructorfabric/insight so it bumps the frontend subchart

.github/workflows/semgrep.yml

@@ -0,0 +1,113 @@
+name: Semgrep SAST
+
+# Report-only SAST gate (constructorfabric/insight#1478), mirroring
+# constructorfabric/insight's semgrep.yml so findings stay comparable across the two
+# repos.
+#
+# Findings (Semgrep `--config auto` — per-language auto-detection via the registry,
+# matching the org GitLab semgrep-scan component; no `p/rust`/`p/csharp` here since this
+# repo is TypeScript + a little Python in scripts/ci) surface in the GitHub
+# "Security -> Code scanning" tab (SARIF upload) AND as a count in the job summary, but
+# they DO NOT block: `semgrep scan` runs WITHOUT `--error`. Flip to blocking once the
+# baseline is triaged and clean (zero un-waived findings) by adding `--error` here and
+# marking `sast` a required status check.
+#
+# Secret detection is intentionally excluded (`--exclude-rule generic.secrets...`); the
+# separate TruffleHog gate (trufflehog.yml) owns secret scanning.
+
+on:
+  pull_request:
+    branches: [main]
+  schedule:
+    # Nightly full-tree baseline (independent of what any PR touched), 03:27 UTC.
+    - cron: "27 3 * * *"
+  workflow_dispatch:
+
+# A new push obsoletes any run still in flight for the same ref.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sast:
+    name: sast
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read # checkout
+      security-events: write # upload SARIF to Code Scanning
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Semgrep scan (report-only — ratchet to blocking with --error once baseline is clean)
+        # Runs the digest-pinned Semgrep image via `docker run` (not a `container:` job) so the
+        # checkout and SARIF-upload JS actions keep the host runner's Node — the Semgrep image
+        # does not ship Node. No `--error`: findings are reported, never block. Secrets excluded
+        # (TruffleHog owns them). `.semgrepignore` in the repo root prunes build/dep artifacts
+        # and the vendored cypilot kit.
+        # NB: `--config auto` requires metrics ON (it sends language/rule/finding counts — not
+        # source — to semgrep.dev to select rules), so `--metrics off` is intentionally omitted.
+        run: |
+          docker run --rm \
+            -v "${{ github.workspace }}:/src" \
+            -w /src \
+            semgrep/semgrep:1.170.0@sha256:c98f8829eea377274ee4b10656458b078b88232469b2ff913f091c2317347c9d \
+            semgrep scan \
+              --config auto \
+              --exclude-rule generic.secrets.security.detected-generic-secret \
+              --sarif --output semgrep.sarif
+
+      - name: Summarize findings in the job summary
+        if: always()
+        # Null-guarded append (repo convention, cf. ci.yml). Renders a severity + per-rule
+        # breakdown from the SARIF using the stdlib (no jq dependency).
+        run: |
+          [ -f semgrep.sarif ] || exit 0
+          [ -n "${GITHUB_STEP_SUMMARY:-}" ] || exit 0
+          # Link the summary to Code scanning. On PRs the analysis is attributed to the PR
+          # (merge ref) — NOT the branch ref — so filter by pr:<n>; on push/schedule/dispatch
+          # filter by branch. GITHUB_REF_NAME is "<n>/merge" on pull_request events.
+          CS_BASE="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/security/code-scanning"
+          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
+            CS_URL="${CS_BASE}?query=is%3Aopen+pr%3A${GITHUB_REF_NAME%/merge}"
+          else
+            CS_URL="${CS_BASE}?query=is%3Aopen+branch%3A${GITHUB_REF_NAME}"
+          fi
+          python3 - semgrep.sarif "$GITHUB_STEP_SUMMARY" "$CS_URL" <<'PY'
+          import json, sys, collections
+          d = json.load(open(sys.argv[1], encoding="utf-8"))
+          out = open(sys.argv[2], "a", encoding="utf-8")
+          cs_url = sys.argv[3]
+          res = [x for r in d.get("runs", []) for x in r.get("results", [])]
+          total = len(res)
+          sev = collections.Counter((x.get("level") or "warning") for x in res)
+          rules = collections.Counter(x.get("ruleId", "?").split(".")[-1] for x in res)
+          w = out.write
+          w("## Semgrep SAST (report-only)\n\n")
+          w(f"**{total}** finding(s) from `auto` (secrets excluded — TruffleHog owns those). "
+            f"This check does **not** block; full details in [Security -> Code scanning]({cs_url}).\n\n")
+          if total:
+              w("| Severity | Count |\n|---|---:|\n")
+              for s in ("error", "warning", "note"):
+                  if sev.get(s):
+                      w(f"| {s} | {sev[s]} |\n")
+              w("\n<details><summary>Findings by rule</summary>\n\n| Count | Rule |\n|---:|---|\n")
+              for rid, n in rules.most_common():
+                  w(f"| {n} | `{rid}` |\n")
+              w("\n</details>\n")
+          w("\n_Report-only: becomes blocking when `--error` is added and the baseline is clean._\n")
+          PY
+
+      - name: Upload SARIF to GitHub Code Scanning
+        # Skip on fork PRs: they receive a read-only token and cannot upload to Code Scanning,
+        # which would otherwise red-X this report-only job.
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: github/codeql-action/upload-sarif@fb0994ef1c058010acf1efccff928b0a83b1ed54 # v4.32.6
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep

.github/workflows/trivy.yml

@@ -0,0 +1,169 @@
+name: Trivy SCA
+
+# Software-composition analysis over the source tree (constructorfabric/insight#1478).
+# Two passes, matching the org's GitLab trivy-scan component:
+#
+#   gate   — CRITICAL only, blocks. Stop-the-line: a CRITICAL CVE or an embedded secret in a
+#            dependency manifest must be fixed or waived in `.trivyignore` before merge.
+#            Baseline today: 0 CRITICAL, so the gate starts green.
+#   report — HIGH/MEDIUM/LOW, never blocks. Findings land in "Security -> Code scanning"
+#            (SARIF) plus a job-summary table. Baseline today: 10 HIGH / 16 MEDIUM / 3 LOW,
+#            almost all from build-time tooling declared under `dependencies`.
+#
+# Scope: this scans the repository (`trivy fs`) — lock file, Dockerfile, configs. It does NOT
+# see the image that ships: base-image and OS-package CVEs are covered by the `trivy-image`
+# job in docker.yml, which runs against the pushed manifest.
+#
+# The report pass deliberately drops the secret scanner (`--scanners vuln,misconfig`): Code
+# Scanning alerts on a public repository are world-readable, and Trivy's secret findings quote
+# the surrounding match. Secrets stay in the blocking gate, where TruffleHog is the primary
+# owner anyway (trufflehog.yml).
+#
+# Dev dependencies are excluded by Trivy's pnpm default — they are not in the shipped bundle.
+# Add `--include-dev-deps` if we ever want build-time supply-chain coverage here too.
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    # Nightly, 03:41 UTC — after the TruffleHog sweep (03:13) and Semgrep baseline (03:27),
+    # so a bad night shows up as three separate red checks rather than one pile.
+    - cron: "41 3 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  # Digest-pinned Trivy, same convention as semgrep.yml / trufflehog.yml.
+  TRIVY_IMAGE: aquasec/trivy:0.72.0@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f
+
+jobs:
+  gate:
+    name: gate (CRITICAL)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Trivy fs scan — CRITICAL only (blocking)
+        # `--ignore-unfixed` keeps the gate actionable: a CRITICAL with no released fix cannot
+        # be resolved by the PR author, so it belongs in the report pass, not in a merge block.
+        # Waivers go in `.trivyignore` at the repo root, date-scoped:
+        #   CVE-2026-12345   exp:2026-12-31   # tracked in <issue>, fix queued
+        run: |
+          docker run --rm \
+            -v "${{ github.workspace }}:/src:ro" \
+            "$TRIVY_IMAGE" fs \
+              --scanners vuln,secret,misconfig \
+              --severity CRITICAL \
+              --ignore-unfixed \
+              --exit-code 1 \
+              --no-progress \
+              /src
+
+  report:
+    name: report (HIGH/MEDIUM/LOW)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read # checkout
+      security-events: write # upload SARIF to Code Scanning
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Trivy fs scan — HIGH/MEDIUM/LOW (never blocks)
+        # Two output formats from two runs over the same cached DB: SARIF for Code Scanning,
+        # JSON for the summary table below. `--exit-code 0` on both — this pass only reports.
+        run: |
+          set -euo pipefail
+          docker run --rm \
+            -v "${{ github.workspace }}:/src" \
+            -v /tmp/trivy-cache:/root/.cache \
+            "$TRIVY_IMAGE" fs \
+              --scanners vuln,misconfig \
+              --severity HIGH,MEDIUM,LOW \
+              --exit-code 0 \
+              --no-progress \
+              --format sarif --output /src/trivy-fs.sarif \
+              /src
+          docker run --rm \
+            -v "${{ github.workspace }}:/src" \
+            -v /tmp/trivy-cache:/root/.cache \
+            "$TRIVY_IMAGE" fs \
+              --scanners vuln,misconfig \
+              --severity HIGH,MEDIUM,LOW \
+              --exit-code 0 \
+              --no-progress \
+              --format json --output /src/trivy-fs.json \
+              /src
+
+      - name: Summarize findings in the job summary
+        if: always()
+        # Null-guarded append (repo convention, cf. ci.yml). Groups by package so the summary
+        # reflects the unit of remediation ("bump X") rather than the CVE count.
+        run: |
+          [ -f trivy-fs.json ] || exit 0
+          [ -n "${GITHUB_STEP_SUMMARY:-}" ] || exit 0
+          CS_BASE="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/security/code-scanning"
+          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
+            CS_URL="${CS_BASE}?query=is%3Aopen+pr%3A${GITHUB_REF_NAME%/merge}"
+          else
+            CS_URL="${CS_BASE}?query=is%3Aopen+branch%3A${GITHUB_REF_NAME}"
+          fi
+          python3 - trivy-fs.json "$GITHUB_STEP_SUMMARY" "$CS_URL" <<'PY'
+          import json, sys, collections
+          d = json.load(open(sys.argv[1], encoding="utf-8"))
+          out = open(sys.argv[2], "a", encoding="utf-8")
+          cs_url = sys.argv[3]
+          w = out.write
+          vulns, miscfg = [], []
+          for r in d.get("Results") or []:
+              vulns += r.get("Vulnerabilities") or []
+              miscfg += [(r.get("Target"), m) for m in (r.get("Misconfigurations") or [])]
+          w("## Trivy SCA (report-only)\n\n")
+          w(f"**{len(vulns)}** vulnerabilit(ies) + **{len(miscfg)}** misconfiguration(s) at "
+            f"HIGH/MEDIUM/LOW. CRITICAL is handled by the blocking `gate` job. "
+            f"Full details in [Security -> Code scanning]({cs_url}).\n\n")
+          if vulns:
+              sev = collections.Counter(v["Severity"] for v in vulns)
+              w("| Severity | Count |\n|---|---:|\n")
+              for s in ("HIGH", "MEDIUM", "LOW"):
+                  if sev.get(s):
+                      w(f"| {s} | {sev[s]} |\n")
+              # One row per (package, version): that is what an upgrade actually fixes.
+              bundles = collections.defaultdict(list)
+              for v in vulns:
+                  bundles[(v["PkgName"], v.get("InstalledVersion", "?"))].append(v)
+              rank = {"HIGH": 0, "MEDIUM": 1, "LOW": 2}
+              w("\n<details><summary>By package</summary>\n\n| Package | Max | CVEs | Fixed in |\n|---|---|---:|---|\n")
+              for (pkg, ver), items in sorted(
+                      bundles.items(), key=lambda kv: (min(rank.get(i["Severity"], 3) for i in kv[1]), kv[0])):
+                  worst = min(items, key=lambda i: rank.get(i["Severity"], 3))["Severity"]
+                  fixes = sorted({i.get("FixedVersion") or "-" for i in items})
+                  w(f"| `{pkg}@{ver}` | {worst} | {len(items)} | {', '.join(fixes)} |\n")
+              w("\n</details>\n")
+          if miscfg:
+              w("\n<details><summary>Misconfigurations</summary>\n\n| Severity | ID | Target | Title |\n|---|---|---|---|\n")
+              for target, m in miscfg:
+                  w(f"| {m['Severity']} | `{m['ID']}` | `{target}` | {m.get('Title', '')} |\n")
+              w("\n</details>\n")
+          PY
+
+      - name: Upload SARIF to GitHub Code Scanning
+        # Skip on fork PRs: read-only token cannot upload, which would red-X this report-only job.
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: github/codeql-action/upload-sarif@fb0994ef1c058010acf1efccff928b0a83b1ed54 # v4.32.6
+        with:
+          sarif_file: trivy-fs.sarif
+          category: trivy-fs