.

security/scanning/vulnerability-scanning/scripts/scan-repo.sh

@@ -0,0 +1,81 @@
+#!/bin/bash
+# Repository Vulnerability Scanner
+# Scans for vulnerabilities in dependencies and IaC
+# Usage: ./scan-repo.sh [directory] [--output report.json]
+
+set -euo pipefail
+
+SCAN_DIR="${1:-.}"
+OUTPUT="${2:-}"
+
+echo "========================================="
+echo "Repository Security Scan"
+echo "Directory: $SCAN_DIR"
+echo "========================================="
+echo ""
+
+ISSUES_FOUND=0
+
+# Trivy filesystem scan
+if command -v trivy &>/dev/null; then
+    echo "=== Trivy Filesystem Scan ==="
+    trivy fs "$SCAN_DIR" \
+        --severity HIGH,CRITICAL \
+        --scanners vuln,secret,config \
+        --ignore-unfixed \
+        || ISSUES_FOUND=1
+    echo ""
+fi
+
+# Check for secrets with gitleaks
+if command -v gitleaks &>/dev/null; then
+    echo "=== GitLeaks Secret Scan ==="
+    gitleaks detect --source "$SCAN_DIR" --no-git || ISSUES_FOUND=1
+    echo ""
+fi
+
+# Check Terraform with tfsec
+if command -v tfsec &>/dev/null && [ -d "$SCAN_DIR" ]; then
+    if find "$SCAN_DIR" -name "*.tf" -print -quit | grep -q .; then
+        echo "=== TFSec Terraform Scan ==="
+        tfsec "$SCAN_DIR" --minimum-severity HIGH || ISSUES_FOUND=1
+        echo ""
+    fi
+fi
+
+# Check Kubernetes manifests with kubesec
+if command -v kubesec &>/dev/null; then
+    for manifest in $(find "$SCAN_DIR" -name "*.yaml" -o -name "*.yml" 2>/dev/null | head -10); do
+        if grep -q "kind:" "$manifest" 2>/dev/null; then
+            echo "=== Kubesec: $manifest ==="
+            kubesec scan "$manifest" 2>/dev/null || true
+        fi
+    done
+fi
+
+# Python dependencies
+if [ -f "$SCAN_DIR/requirements.txt" ]; then
+    if command -v pip-audit &>/dev/null; then
+        echo "=== Python Dependency Audit ==="
+        pip-audit -r "$SCAN_DIR/requirements.txt" || ISSUES_FOUND=1
+        echo ""
+    fi
+fi
+
+# Node.js dependencies
+if [ -f "$SCAN_DIR/package.json" ]; then
+    if command -v npm &>/dev/null; then
+        echo "=== NPM Audit ==="
+        (cd "$SCAN_DIR" && npm audit --audit-level=high 2>/dev/null) || ISSUES_FOUND=1
+        echo ""
+    fi
+fi
+
+echo "========================================="
+if [ $ISSUES_FOUND -eq 1 ]; then
+    echo "⚠ Security issues found - review above"
+    exit 1
+else
+    echo "✓ No critical security issues found"
+fi
+echo "========================================="