.

security/scanning/vulnerability-scanning/assets/github-action-scan.yaml

@@ -0,0 +1,94 @@
+# GitHub Actions Vulnerability Scanning Workflow
+# Add to .github/workflows/security-scan.yaml
+
+name: Security Scan
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Run daily at midnight
+    - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy-scan:
+    name: Trivy Vulnerability Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run Trivy vulnerability scanner (filesystem)
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'sarif'
+          output: 'trivy-fs-results.sarif'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: 'trivy-fs-results.sarif'
+
+  container-scan:
+    name: Container Image Scan
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Build image
+        run: docker build -t myapp:${{ github.sha }} .
+
+      - name: Run Trivy vulnerability scanner (image)
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: 'myapp:${{ github.sha }}'
+          format: 'sarif'
+          output: 'trivy-image-results.sarif'
+          severity: 'CRITICAL,HIGH'
+          ignore-unfixed: true
+
+      - name: Upload Trivy scan results
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: 'trivy-image-results.sarif'
+
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v3
+        with:
+          fail-on-severity: high
+          deny-licenses: GPL-3.0, AGPL-3.0
+
+  secrets-scan:
+    name: Secret Detection
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Gitleaks scan
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

security/scanning/vulnerability-scanning/assets/trivy-config.yaml

@@ -0,0 +1,70 @@
+# Trivy Configuration
+# Place in project root or ~/.trivy.yaml
+
+# Scan settings
+scan:
+  # Scanners to use
+  scanners:
+    - vuln
+    - secret
+    - config
+  
+  # Severity levels to report
+  severity:
+    - CRITICAL
+    - HIGH
+    - MEDIUM
+
+# Vulnerability settings  
+vulnerability:
+  # Ignore unfixed vulnerabilities
+  ignore-unfixed: true
+  
+  # Vulnerability types
+  type:
+    - os
+    - library
+
+# Secret scanning settings
+secret:
+  config: trivy-secret.yaml
+
+# Misconfiguration settings
+misconfiguration:
+  # Policy paths (custom OPA policies)
+  policy:
+    - ./policies
+
+# Cache settings
+cache:
+  # Cache directory
+  dir: /tmp/trivy-cache
+  
+  # Cache TTL in hours
+  ttl: 24h
+
+# Database settings
+db:
+  # Repository for vulnerability database
+  repository: ghcr.io/aquasecurity/trivy-db
+
+# Output settings
+format: table
+output: ""
+
+# Exit code when vulnerabilities found
+exit-code: 0
+
+# Ignore specific files
+skip-files:
+  - "**/*_test.go"
+  - "**/test/**"
+
+# Ignore specific directories
+skip-dirs:
+  - node_modules
+  - vendor
+  - .git
+
+# Custom ignore file
+ignorefile: .trivyignore.yaml