security: add CI security scanning and purge compromised trivy-action#123
Merged
Conversation
Replace the supply-chain-compromised aquasecurity/trivy-action (CVE-2026-33634) with OSV-Scanner across the `fluid generate ci` generators — forge-cli was emitting the compromised action into every downstream user's generated pipeline. forge-cli's own CI/CD gains: - CodeQL advanced setup (codeql.yml, security-extended query suite) - Semgrep custom rules (.semgrep/fluid-rules.yml) for three CLAUDE.md structural invariants, wired into the existing security job - a dependency-review job (blocks PRs adding vulnerable/bad-licence deps) - a Grype container scan + CycloneDX SBOM in the release pipeline - an OpenSSF Scorecard workflow - deterministic agentic-layer adversarial tests (tests/cli/test_agentic_redteam.py) + a `redteam` pytest marker Upgrade pip/setuptools/wheel in the Docker base so the Grype gate (--fail-on high --only-fixed) passes clean. Every scanner is pinned by commit SHA or version+checksum; no third-party scanner Actions run in forge-cli's own CI.
|
Welcome to FLUID Forge! Thanks for opening your first pull request. Before we review, please make sure:
A maintainer will review your PR soon. Thanks for contributing! |
github-actions
Bot
added
the
needs-docs
📄 Documentation ReminderThis PR appears to be missing a documentation reference. Our docs live in a separate repo. Please update the PR description with one of:
See the Contributing Guide for details. |
github-actions
Bot
added
ci
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
The repo's CodeQL default setup is already configured (actions, javascript, python, typescript). A committed advanced-setup workflow duplicated the python analysis and produced a conflicting second `Analyze (python)` check. Default setup covers more languages than the python-only workflow did, so the workflow is removed in favour of it. Semgrep custom rules, Grype, dependency-review, the SBOM and Scorecard are unaffected — only the redundant CodeQL workflow is dropped.
github-actions
Bot
added
the
needs-docs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens forge-cli's security posture and purges a supply-chain-compromised GitHub Action the CLI was shipping to its own users.
fluid generate ciemittedaquasecurity/trivy-action— compromised in March 2026 (CVE-2026-33634 / GHSA-69fq-xp46-6x23) — into every generated downstream pipeline. It is replaced with OSV-Scanner across all five CI-system generators. forge-cli's own CI/CD then gains layered, pinned scanning.What's added
SAST
.semgrep/fluid-rules.yml— 3 custom rules encoding CLAUDE.md invariants (deleted-module imports, SQL-safety helper bypass, copilotworkspace_rootconfinement), gated in the existingsecurityjob. CodeQL is already provided by the repo's default setup — no workflow added here.Supply chain
dependency-reviewjob — blocks PRs adding vulnerable / disallowed-licence deps.release.yml— Grype container scan (--fail-on high --only-fixed) before the GHCR push, plus a CycloneDX SBOM attached to every release.scorecard.yml— weekly OpenSSF Scorecard.Agentic layer
tests/cli/test_agentic_redteam.py— 35 deterministic, zero-token adversarial tests pinning the copilot's injection-redaction / workspace-confinement / typed-error defenses; newredteampytest marker.Docker
Every scanner is pinned by commit SHA or version+checksum. No third-party scanner Actions run in forge-cli's own CI.
Test plan
Verified locally before opening:
actionlintclean on all workflowsbanditsecurity scan passestests/forge/,tests/cli/, generators,test_security.py); full suite (12,231) collects cleanrelease.ymlGrype gate — built the prod image;grype --fail-on high --only-fixedexits 0 (3 fixable CVEs patched, 37 unfixable base-OS CVEs correctly excluded)check_pinned_actions.pyexit 0 — every action SHA-pinnedFollow-ups (settings — for a maintainer, not code)
mainruleset requiringSecurity ScanandDependency Reviewas status checks.