[cbartz]

What this PR does

Adds a Secscan workflow that scans the four charms (garm, garm-configurator, github-runner-planner, github-runner-webhook-gateway) and three app-image OCI resources on latest/edge with Canonical secscan via sbomber. It runs after each publish to edge, weekly, on demand, and on PRs touching the scan files (same-repo only). A gate script fails the job on unexcluded CVEs; per-artifact exclusion files live in .github/secscan-exclusions/. SECURITY.md documents triage.

Why we need it

SSDLC SEC0025 vulnerability scanning for the GitHub Runner product (ISD-6336).

Checklist

• Changes comply with the project's coding standards and guidelines (see CONTRIBUTING.md and STYLE.md)
• CONTRIBUTING.md has been updated upon changes to the contribution/development process (N/A: no change to dev process)
• Technical author has been assigned to review the PR in case of documentation changes (N/A: only a SECURITY.md section; reviewer to decide)
• I updated docs/changelog.md with user-relevant changes (N/A: CI only)
• I used AI to assist with preparing this PR
• I added or updated tests as needed (gate script unit tests via tox -e secscan-gate-unit; the workflow itself is exercised by this PR's run)
• If integration test modules are used: N/A
• If this PR involves a Grafana dashboard: N/A
• If this PR involves Terraform: N/A
• If this PR involves Rockcraft: N/A
• If this PR adds/removes a charm, or changes a charm's base class, conventions, tooling, or repo structure: N/A
• If this PR changes .copilot-collections.yaml or .github/instructions/: N/A

Test plan

actionlint and zizmor pass (apart from the custom runner label, unknown to actionlint); gate script covered by tox -e secscan-gate-unit (fake secscan-client). Real run is this PR's Secscan check.

Review focus

The zizmor: ignore[self-repository] on the reusable-workflow call in publish_charms.yml; the SSDLC cycle 26.10 in the manifest.

AI-generated message.

[Copilot]

Copilot review overview

🟡 Changes recommended

The gate supplies the secscan token incorrectly and lacks automated coverage for key enforcement paths.

Review effort: Lite
Findings: 1 · 1

Open (2)

• Pass the required token file path to secscan-client result · New
• Add tests for scan state, exclusions, and return-code handling · New

What changed in this PR

Adds Canonical Secscan vulnerability scanning for charms and OCI resources, with CI gating and triage documentation.

Changes:

• Adds scheduled, manual, pull-request, and post-publish scanning.
• Defines scan artifacts, exclusions, and SSDLC metadata.
• Adds CVE gate logic and SECURITY.md guidance.

File	Description
SECURITY.md	Documents vulnerability scanning and triage.
.github/​workflows/​secscan.yaml	Defines the Secscan workflow.
.github/​workflows/​publish_charms.yml	Invokes scanning after publishing.
.github/​secscan-exclusions/​github-runner-webhook-gateway.txt	Exclusions for the webhook gateway charm.
.github/​secscan-exclusions/​github-runner-webhook-gateway-app-image.txt	Exclusions for the webhook gateway image.
.github/​secscan-exclusions/​github-runner-planner.txt	Exclusions for the planner charm.
.github/​secscan-exclusions/​github-runner-planner-app-image.txt	Exclusions for the planner image.
.github/​secscan-exclusions/​garm.txt	Exclusions for the Garm charm.
.github/​secscan-exclusions/​garm-configurator.txt	Exclusions for the configurator charm.
.github/​secscan-exclusions/​garm-app-image.txt	Exclusions for the Garm image.
.github/​scripts/​secscan_gate.py	Gates results on unexcluded vulnerabilities.
.github/​sbomber-manifest.yaml	Defines the seven scanned artifacts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The security-sensitive CI and scanning integration warrants final human review.

Review effort: Lite
Findings: None

Resolved since last review (2)

• Pass the required token file path to secscan-client result
• Add tests for scan state, exclusions, and return-code handling