Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add vulcan-repository-sctrl check #770

Open
wants to merge 1 commit into
base: checkshttp
Choose a base branch
from

Conversation

danfaizer
Copy link
Contributor

This PR adds the vulcan-repository-sctrl check, which provides insights into whether a Git repository has security controls in place.

The check primarily reports two possible findings:

  • Informational finding: Security controls detected in the repository.
  • Medium severity finding: Repository missing security controls.

If security controls are detected in the repository, the check provides a list of these controls in the "check finding resources" table.

Below is an example of how the check's output appears in Lava:

With security controls in place:

STATUS

- vulcan-repository-sctrl → https://REDACTED: FINISHED

SUMMARY

CRITICAL: 0
HIGH: 0
MEDIUM: 0
LOW: 0
INFO: 1

Number of excluded vulnerabilities not included in the summary table: 0

VULNERABILITIES

=== Security control detected in repository (INFO) ===

TARGET
https://REDACTED

AFFECTED RESOURCE
https://REDACTED

RESOURCES
- Security Controls:
  Control: Action running Lava
  Path: .github/workflows/test-build.yaml:39
  Link: (Link)[https://REDACTED/blob/master/.github/workflows/test-build.yaml#L39]
  Control: Dependabot is enabled
  Path:
  Link: (Link)[https://REDACTED/settings/security_analysis]

Without security controls in place:

STATUS

- vulcan-repository-sctrl → https://REDACTED: FINISHED

SUMMARY

CRITICAL: 0
HIGH: 0
MEDIUM: 1
LOW: 0
INFO: 0

Number of excluded vulnerabilities not included in the summary table: 0

VULNERABILITIES

=== Repository missing security controls (MEDIUM) ===

TARGET
https://REDACTED

AFFECTED RESOURCE
https://REDACTED

IMPACT
A repository lacking security controls can lead to expose sensitive information, enable unauthorized access, and other security risks.

RECOMMENDATIONS
- Add a security scanner to your CI/CD pipeline to detect security issues in your codebase.
- If you don't have any default scanner, consider using Lava action in your CI/CD pipeline.

REFERENCES
- https://github.mpi-internal.com/adevinta/lava-action
- https://github.mpi-internal.com/spt-security/lava-internal-action

@danfaizer danfaizer requested a review from seilagamo December 20, 2024 09:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant