Skip to content

Add comprehensive security scanning workflows #258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add comprehensive security scanning workflows #258

wants to merge 1 commit into from

Conversation

lukeina2z
Copy link
Contributor

@lukeina2z lukeina2z commented Sep 23, 2025 •
edited
Loading

This commit implements complete security scanning for aws-xray-daemon:

CodeQL Security Analysis (.github/workflows/codeql-analysis.yml)

  • CodeQL analysis for Go code security scanning with security-extended queries
  • Runs on PR/push and weekly schedule
  • Proper timeouts and job dependencies for reliability

Daily Security Scan (.github/workflows/daily-scan.yml)

  • Scans published Docker images from public.ecr.aws and DockerHub twice daily
  • Detects new vulnerabilities in existing published images
  • Focuses on HIGH/CRITICAL severity issues requiring immediate action
  • Generates actionable summary reports with error handling
  • Continues on error to handle image availability issues

Key Features

  • Comprehensive coverage: source code, dependencies, containers, published images
  • Security-focused: commit hashes, proper permissions, categorized results
  • Production-ready: matches published Docker builds exactly, uses correct Go version (1.23)
  • Robust: proper timeouts, error handling, and job dependencies
  • Actionable: clear reporting and GitHub Security tab integration

Addresses the critical security gap where aws-xray-daemon had no automated security scanning despite being critical infrastructure used in production.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@lukeina2z lukeina2z requested a review from a team as a code owner September 23, 2025 17:24
@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@lukeina2z lukeina2z force-pushed the security-scan-pr branch 2 times, most recently from 4528070 to 2c2c959 Compare September 23, 2025 20:40
@lukeina2z lukeina2z changed the title Add comprehensive security scanning workflows [WIP] Add comprehensive security scanning workflows Sep 24, 2025
@lukeina2z
Enhance security scan workflows with comprehensive Go and Docker scan…
2233764 
…ning

- Add comprehensive CodeQL security analysis workflow with:
  * Multi-layered Go vulnerability scanning (govulncheck, gosec, Nancy)
  * Trivy filesystem and dependency scanning
  * Detailed Go module dependency reporting
  * Enhanced SARIF integration for GitHub Security tab

- Add comprehensive daily security scan workflow with:
  * Go module dependency scanning with multiple tools
  * Published Docker image vulnerability scanning (ECR and Docker Hub)
  * Build artifacts security scanning
  * Detailed reporting with vulnerability counts and actionable insights

- Use Go 1.24.1 to match toolchain requirements and resolve compatibility issues
- Enhanced error handling with continue-on-error for non-critical failures
- Organized artifact collection for different scan types
- Weekly CodeQL analysis and twice-daily comprehensive security scans
@lukeina2z lukeina2z changed the title [WIP] Add comprehensive security scanning workflows Add comprehensive security scanning workflows Sep 24, 2025
@lukeina2z
Copy link
Contributor Author

Tested these two added workflow in my fork repo. They are working as expected.

CodeQL Security Analysis
https://github.com/lukeina2z/aws-xray-daemon/actions/runs/18145746883

Daily Security Scan:
https://github.com/lukeina2z/aws-xray-daemon/actions/runs/18145743999

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lukeina2z