feat: detect vulnerable GitHub Actions #1021

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merged

behnazh-w merged 4 commits into main from behnaz/add-gh-vuln-gha-check

Apr 23, 2025

Member

behnazh-w commented Mar 21, 2025 •

edited

Loading

Summary

This pull request introduces a new check mcn_githubactions_vulnerabilities_1 to detect vulnerable GitHub Actions, enhancing the security of workflows and automating the identification of potential risks in CI/CD pipelines. The key changes include:

Changes

A check for specific versions of third-party GitHub Actions that are known to be affected by vulnerabilities. The version can be a commit SHA associated with a tag (version).
A new module has been added to implement interactions with OSV (Open Source Vulnerability) API.

Documentation

The documentation website has been updated to reflect this new check.
A tutorial has been added to guide users through the process of setting up and using the check in their workflows.

Tests

Integration and unit tests have been added.

oracle-contributor-agreement bot added the OCA Verified label

behnazh-w force-pushed the behnaz/add-gh-vuln-gha-check branch 2 times, most recently from 3f5b70c to e056b7c Compare

March 26, 2025 00:30

behnazh-w force-pushed the behnaz/add-gh-vuln-gha-check branch 5 times, most recently from 6e429f7 to 9776ec8 Compare

April 4, 2025 05:38

behnazh-w marked this pull request as ready for review

April 7, 2025 04:48

behnazh-w requested a review from tromai as a code owner

April 7, 2025 04:48

benmss self-requested a review

April 7, 2025 04:53

benmss reviewed

View reviewed changes

docs/source/index.rst Outdated Show resolved Hide resolved

benmss reviewed

View reviewed changes

docs/source/pages/tutorials/detect_vulnerable_github_actions.rst Outdated Show resolved Hide resolved

benmss reviewed

View reviewed changes

docs/source/pages/tutorials/detect_vulnerable_github_actions.rst Outdated Show resolved Hide resolved

benmss reviewed

View reviewed changes

src/macaron/slsa_analyzer/checks/github_actions_vulnerability_check.py Outdated Show resolved Hide resolved

benmss reviewed

View reviewed changes

src/macaron/slsa_analyzer/checks/github_actions_vulnerability_check.py Outdated Show resolved Hide resolved

benmss reviewed

View reviewed changes

src/macaron/slsa_analyzer/checks/github_actions_vulnerability_check.py Outdated Show resolved Hide resolved

behnazh-w changed the base branch from staging to main

April 8, 2025 04:41

benmss reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/osv_dev.py Outdated Show resolved Hide resolved

benmss reviewed

View reviewed changes

tests/integration/cases/oracle-macaron/test.yaml Outdated Show resolved Hide resolved

benmss reviewed

View reviewed changes

tests/slsa_analyzer/checks/test_github_actions_vulnerability_check.py Outdated Show resolved Hide resolved

benmss reviewed

View reviewed changes

tests/slsa_analyzer/package_registry/test_osv_dev.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

docs/source/pages/cli_usage/command_analyze.rst Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/git_url.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/osv_dev.py Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/osv_dev.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/osv_dev.py Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/osv_dev.py Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/checks/github_actions_vulnerability_check.py Show resolved Hide resolved


          feat: detect vulnerable GitHub Actions

c285cea

Signed-off-by: behnazh-w <[email protected]>

behnazh-w added 3 commits

April 22, 2025 16:40


          docs: update the ER diagram

01fbe4a


          test(integration): change staging to main branch

e13d576

Signed-off-by: behnazh-w <[email protected]>


          chore: address PR feedback

a684508

Signed-off-by: behnazh-w <[email protected]>

behnazh-w force-pushed the behnaz/add-gh-vuln-gha-check branch from 9776ec8 to a684508 Compare

April 22, 2025 06:45

tromai approved these changes

View reviewed changes

Member

tromai left a comment

LGTM. Thanks.

benmss approved these changes

View reviewed changes

behnazh-w merged commit 32aa0cc into main

26 checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels