diff --git a/.github/workflows/pr-security-scan.yml b/.github/workflows/pr-security-scan.yml
new file mode 100644
index 0000000..def5612
--- /dev/null
+++ b/.github/workflows/pr-security-scan.yml
@@ -0,0 +1,49 @@
+name: PR Security Scan
+
+on:
+ pull_request:
+ branches: [main]
+
+permissions:
+ contents: read
+ security-events: write
+ actions: read
+ pull-requests: write
+
+jobs:
+ get-changed-files:
+ name: Get Changed Files
+ runs-on: ubuntu-latest
+ outputs:
+ files: ${{ steps.changed-files.outputs.all_changed_files }}
+ any_changed: ${{ steps.changed-files.outputs.any_changed }}
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+
+ - name: Get changed files
+ id: changed-files
+ uses: tj-actions/changed-files@v46
+ with:
+ separator: ','
+ # Exclude test files from security scan - they contain intentional
+ # path traversal test data that triggers false positives
+ files_ignore: |
+ **/*_test.go
+ **/testdata/**
+
+ security-scan:
+ name: Security Scan
+ needs: get-changed-files
+ if: needs.get-changed-files.outputs.any_changed == 'true'
+ uses: ./.github/workflows/reusable-security-scan.yml
+ with:
+ scan-type: repo
+ fail-on: 'CRITICAL,HIGH'
+ include-files: ${{ needs.get-changed-files.outputs.files }}
+ build-from-source: false
+ secrets:
+ api-token: ${{ secrets.ARMIS_API_TOKEN }}
+ tenant-id: ${{ secrets.ARMIS_TENANT_ID }}
diff --git a/.github/workflows/reusable-security-scan.yml b/.github/workflows/reusable-security-scan.yml
index 3d8bde8..32fbd65 100644
--- a/.github/workflows/reusable-security-scan.yml
+++ b/.github/workflows/reusable-security-scan.yml
@@ -35,6 +35,14 @@ on:
description: 'Scan timeout in minutes'
type: number
default: 60
+ include-files:
+ description: 'Comma-separated list of file paths to scan (relative to repository root)'
+ type: string
+ default: ''
+ build-from-source:
+ description: 'Build CLI from source instead of downloading release (for testing scanner changes)'
+ type: boolean
+ default: false
secrets:
api-token:
description: 'Armis API token for authentication'
@@ -43,6 +51,14 @@ on:
description: 'Tenant identifier for Armis Cloud'
required: true
+# Top-level permissions define the maximum permissions available to this workflow.
+# Job-level permissions further restrict as needed.
+permissions:
+ contents: read
+ security-events: write
+ actions: read
+ pull-requests: write
+
jobs:
security-scan:
name: Armis Security Scan
@@ -62,7 +78,7 @@ jobs:
- name: Run Armis Security Scan
id: armis_scan
- uses: ArmisSecurity/armis-cli@main
+ uses: ./
with:
scan-type: ${{ inputs.scan-type }}
scan-target: ${{ inputs.scan-target }}
@@ -73,6 +89,8 @@ jobs:
output-file: armis-results.sarif
image-tarball: ${{ inputs.image-tarball }}
scan-timeout: ${{ inputs.scan-timeout }}
+ include-files: ${{ inputs.include-files }}
+ build-from-source: ${{ inputs.build-from-source }}
continue-on-error: true
- name: Ensure SARIF exists
@@ -121,7 +139,76 @@ jobs:
if (counts.LOW > 0) body += `| 🔵 LOW | ${counts.LOW} |\n`;
if (counts.INFO > 0) body += `| ⚪ INFO | ${counts.INFO} |\n`;
body += `\n**Total: ${total}**\n`;
- body += `\nView full results
\n\nSee the Security tab or download the \`armis-security-results\` artifact for the complete SARIF report.\nView all ${total} findings
\n\n`;
+
+ // Group results by severity
+ const severityOrder = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO'];
+ const severityEmoji = { CRITICAL: '🔴', HIGH: '🟠', MEDIUM: '🟡', LOW: '🔵', INFO: '⚪' };
+
+ for (const severity of severityOrder) {
+ const severityResults = results.filter(r =>
+ (r.properties?.severity || 'INFO') === severity
+ );
+
+ if (severityResults.length > 0) {
+ body += `### ${severityEmoji[severity]} ${severity} (${severityResults.length})\n\n`;
+
+ for (const r of severityResults) {
+ const file = r.locations?.[0]?.physicalLocation?.artifactLocation?.uri || '';
+ const line = r.locations?.[0]?.physicalLocation?.region?.startLine || '';
+ const location = file ? (line ? `${file}:${line}` : file) : 'Unknown location';
+
+ // Parse title and description from message
+ const msgParts = (r.message?.text || '').split(': ');
+ const title = msgParts[0] || r.ruleId;
+ const description = msgParts.slice(1).join(': ') || '';
+
+ body += `${r.ruleId} - ${title}
\n\n`;
+ body += `**Location:** \`${location}\`\n\n`;
+
+ if (description) {
+ body += `${description}\n\n`;
+ }
+
+ // Code snippet
+ const snippet = r.properties?.codeSnippet;
+ if (snippet) {
+ body += '```\n' + snippet + '\n```\n\n';
+ }
+
+ // CVEs and CWEs
+ const cves = r.properties?.cves || [];
+ const cwes = r.properties?.cwes || [];
+ if (cves.length > 0) {
+ body += `**CVEs:** ${cves.join(', ')}\n\n`;
+ }
+ if (cwes.length > 0) {
+ body += `**CWEs:** ${cwes.join(', ')}\n\n`;
+ }
+
+ // Package info
+ const pkg = r.properties?.package;
+ const version = r.properties?.version;
+ const fixVersion = r.properties?.fixVersion;
+ if (pkg) {
+ let pkgInfo = `**Package:** ${pkg}`;
+ if (version) pkgInfo += ` (${version})`;
+ if (fixVersion) pkgInfo += ` → Fix: ${fixVersion}`;
+ body += pkgInfo + '\n\n';
+ }
+
+ body += `View full results
\n\nNo security issues found.\n