Skip to content

Enhance IaC CI: Checkov SARIF upload, Trivy IaC scan, workflow permissions, and pod securityContext #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tukue merged 2 commits into from
Apr 8, 2026
Merged

Enhance IaC CI: Checkov SARIF upload, Trivy IaC scan, workflow permissions, and pod securityContext #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5347eb4
Scope Trivy scan to app manifests and fix pod security context
tukue Apr 8, 2026
8efee5a
Address CI SARIF resilience and nginx non-root runtime
tukue Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .github/workflows/platform-iac-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ on:

permissions:
contents: read
security-events: write

jobs:
quality-gates:
Expand Down Expand Up @@ -45,4 +46,23 @@ jobs:
with:
directory: .
framework: cloudformation,terraform,github_actions
soft_fail: false
output_format: cli,sarif
output_file_path: console,results.sarif
quiet: true

- name: Upload Checkov SARIF report
if: always()
continue-on-error: true
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: results.sarif
Comment on lines +54 to +59
Copy link
Copy Markdown

@amazon-q-developer amazon-q-developer bot Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add continue-on-error: true to prevent upload failures from masking actual Checkov security findings when the SARIF file doesn't exist or upload service is unavailable.

Suggested change
- name: Upload Checkov SARIF report
if: always()
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: results.sarif
- name: Upload Checkov SARIF report
if: always()
continue-on-error: true
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: results.sarif


- name: Static security scan (Trivy IaC misconfigurations)
uses: aquasecurity/trivy-action@v0.35.0
with:
scan-type: config
scan-ref: applications/gitops/base
hide-progress: true
severity: CRITICAL,HIGH
exit-code: '1'
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ It is also curated as a **Platform Engineering consulting profile project** that
- Secure-by-default guardrails and policy checks
- Repository structure for multi-team and multi-environment operation
- Backstage software template example for self-service service creation
- CI pipeline for platform IaC quality gates (fmt/validate/lint/security)
- CI pipeline for platform IaC quality gates (build/test/synth + Checkov + Trivy security scans)
- GitOps-oriented app delivery guardrails
- OPA/Conftest policy bundle for Kubernetes deployment security checks
- Day-2 DX helpers via `Makefile`
Expand Down
6 changes: 6 additions & 0 deletions applications/gitops/base/sample-service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,12 @@ spec:
labels:
app.kubernetes.io/name: sample-service
spec:
securityContext:
runAsNonRoot: true
runAsUser: 101
runAsGroup: 101
seccompProfile:
type: RuntimeDefault
Comment on lines +25 to +30
Copy link
Copy Markdown

@amazon-q-developer amazon-q-developer bot Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Crash Risk: Pod will fail to start because nginx:1.27.0 runs as root by default, but pod securityContext enforces runAsNonRoot: true. Change to nginx:1.27.0-alpine-slim or add runAsUser/runAsGroup with a non-root UID (e.g., 101) to the pod securityContext, or use an nginx image variant that runs as non-root by default.

Suggested change
securityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
runAsNonRoot: true
runAsUser: 101
runAsGroup: 101
seccompProfile:
type: RuntimeDefault

containers:
- name: app
image: nginx:1.27.0
Expand Down
Loading