Adding SAST-SCA #2108
Adding SAST-SCA #2108
Conversation
|
Build Error! No Linked Issue found. Please link an issue or mention it in the body using #<issue_id> |
PR SummaryAdded security-focused GitHub Actions workflows for Static Application Security Testing (SAST) and Software Composition Analysis (SCA). The changes introduce a CodeQL analysis workflow (currently disabled) for Swift code scanning on push/PR events to main and dev branches, and a dependency review workflow that blocks PRs introducing known-vulnerable packages of moderate severity or higher. The dependency review workflow includes automated PR comments with vulnerability details and remediation guidance. Changes
autogenerated by presubmit.ai |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🚨 Pull request needs attention.
Review Summary
Commits Considered (1)
- 46255a1: Adding SAST-SCA
Files Processed (2)
- .github/workflows/code-analysis.yml (1 hunk)
- .github/workflows/dependency-review.yml (1 hunk)
Actionable Comments (2)
-
.github/workflows/code-analysis.yml [29-29]
possible bug: "Non-existent action version referenced."
-
.github/workflows/dependency-review.yml [28-28]
possible bug: "Non-existent action version referenced."
Skipped Comments (2)
-
.github/workflows/dependency-review.yml [49-49]
possible issue: "JSON parsing may fail on unexpected input."
-
.github/workflows/code-analysis.yml [10-10]
enhancement: "Daily scheduled runs may be excessive."
|
Build Error! No Linked Issue found. Please link an issue or mention it in the body using #<issue_id> |
There was a problem hiding this comment.
🚨 Pull request needs attention.
Review Summary
Commits Considered (1)
- deca9a8: Updates to branch
Files Processed (2)
- .github/workflows/code-analysis.yml (1 hunk)
- .github/workflows/dependency-review.yml (1 hunk)
Actionable Comments (2)
-
.github/workflows/code-analysis.yml [29-29]
possible bug: "Non-existent action version will cause workflow failure."
-
.github/workflows/dependency-review.yml [28-28]
possible bug: "Non-existent action version will cause workflow failure."
Skipped Comments (1)
-
.github/workflows/dependency-review.yml [56-68]
readability: "Template string indentation will appear in the rendered PR comment."
|
Build Error! No Linked Issue found. Please link an issue or mention it in the body using #<issue_id> |
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (1)
- 84795d0: Fix checkout action version and enable dev & main branch scanning
Files Processed (2)
- .github/workflows/code-analysis.yml (1 hunk)
- .github/workflows/dependency-review.yml (1 hunk)
Actionable Comments (0)
Skipped Comments (4)
-
.github/workflows/code-analysis.yml [34-34]
security: "Pin GitHub Actions to commit SHA for improved security."
-
.github/workflows/code-analysis.yml [22-22]
best practice: "Unnecessary permission granted to workflow."
-
.github/workflows/dependency-review.yml [49-49]
possible bug: "Potential JSON parsing error when vulnerability output is empty or malformed."
-
.github/workflows/dependency-review.yml [43-43]
security: "Pin GitHub Actions to commit SHA for improved security."
|
Fixes #2113 |
|
Build Error! No Linked Issue found. Please link an issue or mention it in the body using #<issue_id> |
|
@JGowsk9 It seem the build |
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (1)
- eaf200c: Fix CodeQL autobuild with custom build steps
Files Processed (1)
- .github/workflows/code-analysis.yml (1 hunk)
Actionable Comments (0)
Skipped Comments (4)
-
.github/workflows/code-analysis.yml [34-34]
security: "Pin GitHub Actions to commit SHA for improved security."
-
.github/workflows/code-analysis.yml [31-31]
security: "Pin GitHub Actions to commit SHA for improved security."
-
.github/workflows/code-analysis.yml [61-61]
security: "Pin GitHub Actions to commit SHA for improved security."
-
.github/workflows/code-analysis.yml [12-12]
enhancement: "Consider offsetting the scheduled run time."
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (1)
- c5efc4c: Merge branch 'dev' into sec/sast-sca
Files Processed (0)
Actionable Comments (0)
Skipped Comments (0)
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (1)
- 3779038: Simplify CodeQL build to use xcodeproj instead of workspace
Files Processed (1)
- .github/workflows/code-analysis.yml (1 hunk)
Actionable Comments (0)
Skipped Comments (3)
-
.github/workflows/code-analysis.yml [34-34]
best practice: "Consider pinning GitHub Actions to specific versions for reproducibility."
-
.github/workflows/code-analysis.yml [12-12]
enhancement: "Consider adjusting the scheduled cron time to avoid peak hours."
-
.github/workflows/code-analysis.yml [22-22]
security: "Unused permission declared in workflow."
Thanks, @lmcmz ! Any suggestions on how to get a successful build? I've tried both Autobuild and custom builds |
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (1)
- a8009bf: Fix xcodebuild architecture conflict in CodeQL workflow
Files Processed (1)
- .github/workflows/code-analysis.yml (1 hunk)
Actionable Comments (0)
Skipped Comments (3)
-
.github/workflows/code-analysis.yml [34-34]
security: "Pin GitHub Actions to commit SHA for improved security."
-
.github/workflows/code-analysis.yml [54-54]
security: "Pin GitHub Actions to commit SHA for improved security."
-
.github/workflows/code-analysis.yml [22-22]
best practice: "Unused permission may be overly permissive."
There was a problem hiding this comment.
✅ LGTM!
Review Summary
Commits Considered (1)
- 551d0af: Temporarily disable CodeQL workflow
Files Processed (1)
- .github/workflows/code-analysis.yml.disabled (1 hunk)
Actionable Comments (0)
Skipped Comments (3)
-
.github/workflows/code-analysis.yml.disabled [34-34]
security: "Pin GitHub Actions to specific commit SHA for supply chain security."
-
.github/workflows/code-analysis.yml.disabled [54-54]
security: "Pin GitHub Actions to specific commit SHA for supply chain security."
-
.github/workflows/code-analysis.yml.disabled [12-12]
enhancement: "Consider reducing scheduled scan frequency to conserve resources."
Security
-Adding Code Analysis
-Adding Dependency Review
-This Will Block Failing PRs
Fixes #2113