security-scanning-workflows

Automating security scanning in CI/CD pipelines involves integrating SAST, dependency checks, and container vulnerability detection into GitHub Actions workflows. This skill triggers on push and pull_request events for main or develop branches, applying automated risk findings and policy-enforced gates to secure code changes.

GitHub Actions supports combined SAST and container scanning using CodeQL and Trivy. This skill automates both by running CodeQL for code-level vulnerability detection and Trivy for container image scanning before deployment, ensuring comprehensive pipeline security coverage.

Uploading SARIF reports directly through GitHub Actions CI/CD workflows is the best method. This skill handles SARIF upload automatically, centralizing vulnerability findings from SAST and container scans into the GitHub Security tab for governance and visibility.

You can enforce security gates and minimal permissions for pull requests on main branches. This skill configures secure merge gating within GitHub Actions, automatically blocking risky changes by validating dependency review and scanning results before allowing merges.

Running dependency review and license checks in GitHub Actions PRs requires applying this skill's workflow to your repository. It automatically executes dependency scanning with vulnerability checks during pull_request events, preventing insecure dependencies from merging into your main or develop branches.

SARIF upload and minimal permissions are required for CI/CD security workflows to centralize findings and prevent unauthorized access. This skill meets these requirements by uploading SARIF to the GitHub Security tab and restricting workflow permissions, ensuring safe and governed code integration.