[B2] ci: add CodeQL + gitleaks + Trivy + SBOM security pipeline

[MichaelFisher1997]

Part of #834 (Production-Readiness Audit) — Batch B2 (hardening, parallel-safe).
Replaces audit item #8 (P1). Parallel with: audit-b2 siblings — this issue owns a new workflow file.

Problem

No security / supply-chain scanning today. Missing:

• SAST: CodeQL or Semgrep
• Dependency vulnerabilities: Trivy / Grype / nix flake show audit
• Secret scanning: gitleaks / trufflehog (PR + history)
• SBOM: CycloneDX / SPDX generation
• Provenance: SLSA / sigstore signing of build artifacts

The repo already grants id-token: write to build jobs, so signing/provenance is the natural next step.

Acceptance criteria

• New .github/workflows/security.yml with:
  • CodeQL analysis (autobuild or build-mode; Zig support is limited — fall back to Semgrep if CodeQL lacks Zig).
  • gitleaks scan on every PR + full history on schedule.
  • Trivy filesystem + nix flake show dependency scan.
  • SBOM generated (CycloneDX) and uploaded as artifact + to GH Dependency graph API.
• Workflow runs on pull_request:, push: dev, and scheduled (nightly).
• Findings fail the PR (configurable severity threshold — start at CRITICAL/HIGH).
• Optional phase 2: SLSA provenance + sigstore signing of release artifacts.

Files in scope

• .github/workflows/security.yml (new)
• .github/codeql.yml or codeql config (new, if CodeQL used)
• .gitleaks.toml (new, if custom rules)

Out of scope

• SECURITY.md policy file (B1-4 / audit Implement data-driven biome system #9, [B1] repo: add SECURITY.md, CODEOWNERS, CODE_OF_CONDUCT.md #862).
• Branch-protection required-checks wiring (coordinate with B2-3/B2-4).

Branch / PR

• Branch: ci/security-pipeline · Targets: dev

[github-actions]

Triage: Feature Request — security pipeline

Classification: Feature Request (CI hardening, Batch B2 of audit #834). Scope is appropriate for a single PR (one new workflow file, four parallel jobs).

Validation against existing infrastructure

Confirmed pre-conditions are in place:

• id-token: write is already granted on build.yml:58, 97, 142 — SLSA / cosign phase 2 will work without re-toggling permissions.
• dependabot.yml already tracks package-ecosystem: github-actions, so the new security actions (gitleaks, trivy, codeql-setup) will get auto-PR'd weekly.
• .github/workflows/workflow-validation.yml already lints .github/workflows/** with actionlint + YAML parsing — the new security.yml is auto-validated on PR without extra wiring.

Gaps / ambiguities in the ACs worth resolving before implementation

1. CodeQL on Zig — not viable. CodeQL has no first-class Zig support; languages: zig will silently produce no queries. Recommend either:

   • Drop CodeQL and use Semgrep with p/security-audit + p/owasp-top-ten as the SAST layer, OR
   • Run CodeQL on c.zig + bundled C/Vulkan headers only (languages: cpp) and pair it with Semgrep for Zig.
     Either way, please pick one and update the AC so it's measurable.

2. SBOM source of truth — pick a generator explicitly. Nix + Zig has no first-party CycloneDX emitter. Concrete options:

   • nix flake archive --json → SPDX via a small Python converter, OR
   • cyclonedx/cyclonedx-python running over the resolved flake.lock deps, OR
   • syft (anchore/sbom-action) scanning result/ after nix build.
     Whichever you pick, the GH Dependency Graph API only auto-ingests SPDX 2.3; CycloneDX lands only as an artifact. Worth pinning that in the AC.

3. Action pinning. Given this workflow's purpose, please pin every third-party action by SHA (uses: aquasecurity/trivy-action@<full-sha> etc.), not tag, and rely on dependabot to bump them.

4. nix flake show as a vuln scan is a misnomer — it just dumps the flake's outputs/metadata. If Trivy is also running, you may not need a separate nix flake show step; flagging so the AC matches what actually runs.

5. Concurrency on pull_request. The build workflow uses cancel-in-progress: true per ref. Recommend the same here so security scans don't pile up on force-pushes.

6. Secrets baseline. Before merging, please run gitleaks detect --no-git -s . once locally against the current tree to seed .gitleaks.toml allowlists — historical false positives otherwise flood the first runs.

Scope check

• Single file (.github/workflows/security.yml) + optional config is the right granularity; do not split into four sub-PRs.
• Phase 2 (SLSA + cosign) is correctly tagged optional — defer until B2-3/B2-4 lands required-check wiring.

Suggested next step

Open the PR on branch ci/security-pipeline with the four CodeQL/Semgrep choice and SBOM generator choice called out in the PR description so reviewers don't have to chase the design through comments.

[github-actions]

Comment posted on issue #868. Summary:

• Classification: Feature Request (Batch B2 CI hardening under audit Production-Readiness Audit: missing CI / lint / benchmark / regression guardrails #834).
• Validated: id-token: write already in build.yml:58,97,142; dependabot already covers github-actions; workflow-validation.yml will auto-lint the new file.
• Flagged 6 items for the implementer: (1) CodeQL has no Zig support — pick Semgrep or scope CodeQL to C/C++ only, (2) pin a concrete SBOM generator (CycloneDX/SPDX), (3) pin all third-party actions by SHA, (4) nix flake show is metadata not vuln scan, (5) add concurrency: cancel-in-progress, (6) run a one-off gitleaks baseline before adding custom rules.
• Scope: appropriate for one PR; do not split. Phase 2 (SLSA/cosign) correctly deferred.

opencode session  |  github run