Set up minimal security scanners (CI)

[ktursunov]

Goal

Establish a minimal security-scanning baseline in CI for the Security quality vector (currently undefined in the Quality Framework). Start report-only, then ratchet to gating once thresholds are agreed with the team.

Scope (minimal first pass)

• Secret scanning on PRs (e.g. gitleaks / GitHub secret scanning).
• Dependency / vulnerability scan: cargo audit (Rust workspace), pnpm audit (frontend), and a container-image scan (e.g. Trivy) for the images we build.
• SAST baseline: CodeQL for the languages in the repo — report-only to start.

Acceptance

• Each scanner runs on PRs to main, surfaced in checks / job summary (report-only, non-blocking at first).
• Real findings are triaged; follow-up issues filed for anything actionable.
• Gate thresholds (what blocks a PR) decided with the team before flipping any scanner to blocking.

Children

The bundled security-gates.yml (PR #1463) was closed and decomposed into a per-tool task
per scanner, so each can be triaged and ratcheted to blocking independently:

• ci(security): Trivy scan gate — misconfig + fs + image (split from #1463) #1796 — Trivy: IaC/Dockerfile misconfig + filesystem vuln scan (.trivyignore waivers → Security: trivy-config HIGH misconfigurations — root containers + frontend Deployment securityContext (waivers) #1340).
• ci(security): Semgrep SAST gate (split from #1463) #1797 — Semgrep (SAST): p/default report-only → --error once baseline is clean. (Uses Semgrep, not CodeQL — matches the org AppSec stack.)
• Secret scanning — TruffleHog (verified secrets hard-fail); not yet split into its own task.
• Dependency audit — cargo audit + pip-audit (waivers → Security: Rust dependency advisories — RSA Marvin (no fix) + 2 unmaintained crates (deps-audit waivers) #1339); not yet split into its own task.

---

Part of the Quality Framework → Security vector. QA-owned. Tracked on the Insights project.

Planning: first pass starts next week — ETA 15 Jul 2026 · Konstantin Tursunov.

[ktursunov]

Superseded — split into per-scanner gate tasks that are being triaged and ratcheted to blocking independently:

• ci(security): Trivy scan gate — misconfig + fs + image (split from #1463) #1796 — Trivy misconfig + fs scan gate
• ci(security): Semgrep SAST gate (split from #1463) #1797 — Semgrep SAST gate

Closing this umbrella as duplicated by both.