[cbartz]

Summary

Adds a Secscan workflow that scans the five Linux runner tarballs (x64, arm64, ppc64le, s390x, arm) with Canonical secscan (Trivy). release.yml also runs it on the freshly built packages, alongside the release: a failing scan marks the run red but does not block the release. It also runs weekly against the latest release, on demand, and on PRs touching its own files (same-repo PRs only). Per-runtime exclusion files live in .github/secscan-exclusions/; SECURITY.md documents the triage flow.

Why

SSDLC SEC0025 vulnerability scanning for the GitHub Runner product (ISD-6336).

Testing

• Exit-code classifier and exclusion-selection logic checked with a shell harness (incl. a deliberately broken copy).
• actionlint (only unknown custom runner-label notices) and zizmor on secscan.yaml are clean.
• The Secscan checks on this PR scan the latest release.

Note: release branches (releases/**) cut before this merges lack secscan.yaml and need it cherry-picked to scan their next release.

AI-generated message.

[Copilot]

Copilot review overview

🟡 Changes recommended

The private-runner trust issue and non-idempotent installation issue must be addressed before approval.

Review effort: Lite
Findings: 1 · 1

Open (2)

• Untrusted PR code runs on a private self-hosted runner · New
• Comment incorrectly describes the non-blocking release scan · New

What changed in this PR

Adds Canonical Secscan vulnerability scanning for Linux runner release tarballs, with release integration, reporting, exclusions, and triage documentation.

Changes:

• Adds scheduled, manual, release, and same-repository PR scanning.
• Integrates scanning without blocking release publication.
• Adds security guidance and per-runtime exclusion files.

File	Summary
SECURITY.md	Documents scanning and triage; HTML report availability wording needs clarification (nit).
.github/​workflows/​secscan.yaml	Defines scanning and reporting; includes a critical private-runner trust issue, moderate non-idempotent installation issue, and inaccurate blocking comment (nit).
.github/​workflows/​release.yml	Invokes scans for release artifacts.
.github/​secscan-exclusions/​linux-x64.txt	Provides x64 exclusions.
.github/​secscan-exclusions/​linux-s390x.txt	Provides s390x exclusions.
.github/​secscan-exclusions/​linux-ppc64le.txt	Provides ppc64le exclusions.
.github/​secscan-exclusions/​linux-arm64.txt	Provides arm64 exclusions.
.github/​secscan-exclusions/​linux-arm.txt	Provides arm exclusions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The Secscan workflow must clean up staged packages, tokens, and exclusion files after each scan.

Review effort: Lite
Findings: None

Resolved since last review (2)

• Untrusted PR code runs on a private self-hosted runner
• Comment incorrectly describes the non-blocking release scan

[Copilot]

Copilot review overview

🟡 Changes recommended

Concurrent jobs can collide through shared staging paths and wildcard cleanup.

Review effort: Lite
Findings: 1

Open (1)

• Use isolated per-run staging directories to prevent concurrent cleanup collisio… · New

[Copilot]

Copilot review overview

🔵 Needs a closer look

The workflow has a concurrent snap-install race that can fail valid scans.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Use isolated per-run staging directories to prevent concurrent cleanup collisio…

Previously missed (1)

In code that hasn't changed since last review

Serialize concurrent snap installation on self-hosted hosts

.github/​workflows/​secscan.yaml:47

The matrix can place several jobs on the same self-hosted host, so they can all observe the snap as absent and race into snap install. The later installers can fail with “already installed,” causing otherwise valid scans to fail before they start; serialize this host-wide installation or treat that specific race as success.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Serialize or retry snap installation and interface connections to avoid matrix-job races.

Review effort: Lite
Findings: None