ci: add ThreatCrush security scan

[ralyodio]

Sample install — the one you asked to see before the fleet rollout. Installs threatcrush-scan@1.1.0 from the sh1pt Actions Store.

Scans PRs for hardcoded credentials, injection, SSRF, unsafe deserialisation, XXE and dependency tampering. Findings go to the Security tab as SARIF and to a PR comment; snippets are redacted, so no credential material reaches a CI log. Report-only — it will not fail a PR on findings.

Read this PR's CI history — it's the interesting part

Run 1 — green, and wrong. Reported 0 findings. The runner installed the published @profullstack/threatcrush@0.2.2, which has no --format:

error: unknown option '--format'

Commander exits 1 — the same code the CLI uses for "findings at or above failOn". The step read a failure as a result, no SARIF was written, the empty-run fallback supplied one, and the comment declared the repo clean. A green check on a repository nothing had scanned.

Run 2 — red, but the comment still lied. The new capability check failed the job correctly, yet the comment still said "0 findings": the report tested status == "error", and a skipped step yields an empty string, so it fell through to the happy path.

Run 3 — red and honest. "NOT RUN — the scan did not complete, so this diff was not examined." Correct, but useless: it refused to scan anything until a new CLI shipped.

Run 4 — green, and genuinely scanned. The workflow now detects the interface up front and converts 0.2.2's text output when --format is missing:

CLI 0.2.2 predates --format; converting terminal output instead.
✔ Scanned 5 files
  ✓ No security issues found!
converted 0 finding(s) to threatcrush.sarif

That 0 findings is a real clean result — 5 files scanned, completion footer present — not the absence of one. The difference between run 1 and run 4 is the whole point.

Coverage

The legacy converter is a stopgap. 0.2.2 is a secrets scanner: 12.9% true-positive rate against profullstack/malware-test-prs, at 0.0% false positives.

Once profullstack/threatcrush#73 is merged and published, the workflow picks the native --format sarif path automatically and coverage goes to 90.32% at the same 0.0% false-positive rate. No change needed here.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

ThreatCrush Security Scan

0 finding(s)

No findings.