feat: detect vulnerable GitHub Actions#1021

Merged

behnazh-w merged 4 commits intomainfrom

behnaz/add-gh-vuln-gha-check

Apr 23, 2025

Member

behnazh-w commented Mar 21, 2025 •

edited

Loading

Summary

This pull request introduces a new check mcn_githubactions_vulnerabilities_1 to detect vulnerable GitHub Actions, enhancing the security of workflows and automating the identification of potential risks in CI/CD pipelines. The key changes include:

Changes

A check for specific versions of third-party GitHub Actions that are known to be affected by vulnerabilities. The version can be a commit SHA associated with a tag (version).
A new module has been added to implement interactions with OSV (Open Source Vulnerability) API.

Documentation

The documentation website has been updated to reflect this new check.
A tutorial has been added to guide users through the process of setting up and using the check in their workflows.

Tests

Integration and unit tests have been added.

oracle-contributor-agreement Bot added the OCA Verified label

behnazh-w force-pushed the behnaz/add-gh-vuln-gha-check branch 2 times, most recently from 3f5b70c to e056b7c Compare

March 26, 2025 00:30

behnazh-w force-pushed the behnaz/add-gh-vuln-gha-check branch 5 times, most recently from 6e429f7 to 9776ec8 Compare

April 4, 2025 05:38

behnazh-w marked this pull request as ready for review

April 7, 2025 04:48

behnazh-w requested a review from tromai as a code owner

April 7, 2025 04:48

benmss self-requested a review

April 7, 2025 04:53

benmss reviewed

View reviewed changes

docs/source/index.rst Outdated

benmss reviewed

View reviewed changes

docs/source/pages/tutorials/detect_vulnerable_github_actions.rst Outdated

benmss reviewed

View reviewed changes

docs/source/pages/tutorials/detect_vulnerable_github_actions.rst Outdated

benmss reviewed

View reviewed changes

src/macaron/slsa_analyzer/checks/github_actions_vulnerability_check.py Outdated

benmss reviewed

View reviewed changes

src/macaron/slsa_analyzer/checks/github_actions_vulnerability_check.py Outdated

benmss reviewed

View reviewed changes

src/macaron/slsa_analyzer/checks/github_actions_vulnerability_check.py Outdated

behnazh-w changed the base branch from staging to main

April 8, 2025 04:41

benmss reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/osv_dev.py Outdated

benmss reviewed

View reviewed changes

tests/integration/cases/oracle-macaron/test.yaml Outdated

benmss reviewed

View reviewed changes

tests/slsa_analyzer/checks/test_github_actions_vulnerability_check.py Outdated

benmss reviewed

View reviewed changes

tests/slsa_analyzer/package_registry/test_osv_dev.py

tromai reviewed

View reviewed changes

docs/source/pages/cli_usage/command_analyze.rst Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/git_url.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/osv_dev.py

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/osv_dev.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/osv_dev.py

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/osv_dev.py

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/checks/github_actions_vulnerability_check.py


          feat: detect vulnerable GitHub Actions

c285cea

Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>

behnazh-w added 3 commits

April 22, 2025 16:40


          docs: update the ER diagram

01fbe4a


          test(integration): change staging to main branch

e13d576

Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>


          chore: address PR feedback

a684508

Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>

behnazh-w force-pushed the behnaz/add-gh-vuln-gha-check branch from 9776ec8 to a684508 Compare

April 22, 2025 06:45

tromai approved these changes

View reviewed changes

Contributor

tromai left a comment

LGTM. Thanks.

benmss approved these changes

View reviewed changes

behnazh-w merged commit 32aa0cc into main

26 checks passed

behnazh-w deleted the behnaz/add-gh-vuln-gha-check branch

July 22, 2025 02:16

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels