security-scanning-workflows

Automate SAST, dependency, and container security scans in CI/CD pipelines.

3|3|Updated Jan 4, 2026

Search Tags:#security #github-actions #ci-cd #codeql #trivy #sarif #dependency-review

Ready to run

npx skills add https://github.com/adaptive-enforcement-lab/claude-skills --skill security-scanning-workflows

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-scanning-workflows
Source: https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/secure/skills/security-scanning-workflows
Command: npx skills add https://github.com/adaptive-enforcement-lab/claude-skills --skill security-scanning-workflows

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Organizations struggle to ensure code safety and compliance across CI/CD pipelines as they push changes rapidly. This skill provides ready-to-use security scanning workflows that cover SAST with CodeQL, dependency scanning, container image scanning, and SARIF reporting to GitHub Security tab, enabling faster risk visibility and governance.

Core Features & Use Cases

SAST with CodeQL for code-level vulnerability detection across languages
Dependency scanning with license and vulnerability checks in PRs
Container image scanning with Trivy before deployment
SARIF upload to GitHub Security tab for centralized findings
Security gates and minimal permissions to block risky changes
Works across push and PR workflows, on main/develop branches

Quick Start

Integrate the multi-scan workflow into your repo by applying the example Security Scanning workflow in your workflows directory.

Frequently Asked Questions about security-scanning-workflows

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate security scanning in CI/CD pipelines for GitHub Actions?▼

Automating security scanning in CI/CD pipelines involves integrating SAST, dependency checks, and container vulnerability detection into GitHub Actions workflows. This skill triggers on push and pull_request events for main or develop branches, applying automated risk findings and policy-enforced gates to secure code changes.

Does GitHub Actions support CodeQL and Trivy for combined SAST and container scanning?▼

GitHub Actions supports combined SAST and container scanning using CodeQL and Trivy. This skill automates both by running CodeQL for code-level vulnerability detection and Trivy for container image scanning before deployment, ensuring comprehensive pipeline security coverage.

What is the best way to upload SARIF reports to the GitHub Security tab?▼

Uploading SARIF reports directly through GitHub Actions CI/CD workflows is the best method. This skill handles SARIF upload automatically, centralizing vulnerability findings from SAST and container scans into the GitHub Security tab for governance and visibility.

Can I enforce security gates and minimal permissions for pull requests on main branches?▼

You can enforce security gates and minimal permissions for pull requests on main branches. This skill configures secure merge gating within GitHub Actions, automatically blocking risky changes by validating dependency review and scanning results before allowing merges.

How do I run dependency review and license checks in GitHub Actions PRs?▼

Running dependency review and license checks in GitHub Actions PRs requires applying this skill's workflow to your repository. It automatically executes dependency scanning with vulnerability checks during pull_request events, preventing insecure dependencies from merging into your main or develop branches.

Why do I need SARIF upload and minimal permissions for CI/CD security workflows?▼

SARIF upload and minimal permissions are required for CI/CD security workflows to centralize findings and prevent unauthorized access. This skill meets these requirements by uploading SARIF to the GitHub Security tab and restricting workflow permissions, ensuring safe and governed code integration.