{"id":50674035,"url":"https://github.com/garretpatten/security-guardrails","last_synced_at":"2026-06-08T14:30:31.872Z","repository":{"id":324310168,"uuid":"1071465908","full_name":"garretpatten/security-guardrails","owner":"garretpatten","description":"Reusable GitHub Actions guardrails for pull requests: OpenGrep SAST, verified TruffleHog secrets, dependency review, and Trivy supply-chain checks — high signal, low noise.","archived":false,"fork":false,"pushed_at":"2026-05-28T23:34:57.000Z","size":24,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-05-29T01:12:10.301Z","etag":null,"topics":["ci-cd","devsecops","github-actions","opengrep","reusable-workflows","sast","sbom","secret-scanning","security","supply-chain-security","trivvy","trufflehog"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/garretpatten.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2025-10-07T11:44:05.000Z","updated_at":"2026-05-28T23:38:52.000Z","dependencies_parsed_at":"2026-05-18T06:04:08.606Z","dependency_job_id":null,"html_url":"https://github.com/garretpatten/security-guardrails","commit_stats":null,"previous_names":["garretpatten/security-checks"],"tags_count":0,"template":false,"template_full_name":"garretpatten/template","purl":"pkg:github/garretpatten/security-guardrails","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garretpatten%2Fsecurity-guardrails","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garretpatten%2Fsecurity-guardrails/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garretpatten%2Fsecurity-guardrails/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garretpatten%2Fsecurity-guardrails/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/garretpatten","download_url":"https://codeload.github.com/garretpatten/security-guardrails/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garretpatten%2Fsecurity-guardrails/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34067347,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-08T02:00:07.615Z","response_time":111,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ci-cd","devsecops","github-actions","opengrep","reusable-workflows","sast","sbom","secret-scanning","security","supply-chain-security","trivvy","trufflehog"],"created_at":"2026-06-08T14:30:30.885Z","updated_at":"2026-06-08T14:30:31.867Z","avatar_url":"https://github.com/garretpatten.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!-- markdownlint-disable MD033 MD041 --\u003e\n\n\u003cp align=\"center\"\u003e\n    \u003cimg\n        src=\"./docs/assets/security-guardrails-mark.svg\"\n        alt=\"Security Guardrails shield logo\"\n        width=\"96\"\n        height=\"96\"\n    /\u003e\n\u003c/p\u003e\n\n\u003ch1 align=\"center\"\u003eSecurity Guardrails\u003c/h1\u003e\n\n\u003cp align=\"center\"\u003e\n    \u003cstrong\u003eHigh-signal reusable GitHub Actions security gates for pull requests.\u003c/strong\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n    OpenGrep SAST, verified-only TruffleHog secrets, dependency review, Trivy\n    vulnerability and license audits, and CycloneDX SBOM artifacts — tuned for\n    low noise and actionable findings.\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n    \u003ca href=\"./LICENSE\"\n        \u003e\u003cimg\n            src=\"https://img.shields.io/github/license/garretpatten/security-guardrails?style=flat-square\"\n            alt=\"License: MIT\"\n    /\u003e\u003c/a\u003e\n    \u003cimg\n        src=\"https://img.shields.io/badge/SAST-OpenGrep-2563eb?style=flat-square\u0026logo=securityscorecard\u0026logoColor=white\"\n        alt=\"SAST: OpenGrep\"\n    /\u003e\n    \u003cimg\n        src=\"https://img.shields.io/badge/secrets-TruffleHog%20verified-7c3aed?style=flat-square\"\n        alt=\"Secrets: TruffleHog verified only\"\n    /\u003e\n    \u003cimg\n        src=\"https://img.shields.io/badge/supply%20chain-Trivy%20%2B%20SBOM-0ea5e9?style=flat-square\u0026logo=dependabot\u0026logoColor=white\"\n        alt=\"Supply chain: Trivy and CycloneDX SBOM\"\n    /\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n    \u003ca href=\"https://github.com/garretpatten/security-guardrails/actions/workflows/test-workflow.yaml\"\n        \u003e\u003cimg\n            src=\"https://img.shields.io/github/actions/workflow/status/garretpatten/security-guardrails/test-workflow.yaml?branch=master\u0026label=CI\u0026logo=github\u0026style=flat-square\"\n            alt=\"Test workflow status\"\n    /\u003e\u003c/a\u003e\n    \u003ca href=\"https://github.com/garretpatten/security-guardrails/actions/workflows/quality-checks.yaml\"\n        \u003e\u003cimg\n            src=\"https://img.shields.io/github/actions/workflow/status/garretpatten/security-guardrails/quality-checks.yaml?branch=master\u0026label=quality\u0026logo=github\u0026style=flat-square\"\n            alt=\"Quality checks workflow status\"\n    /\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n    ✓ PR-scoped SAST \u0026nbsp;\n    ✓ Verified secrets only \u0026nbsp;\n    ✓ CRITICAL/HIGH CVEs \u0026nbsp;\n    ✓ Copyleft license guardrails \u0026nbsp;\n    ✓ CycloneDX SBOM artifacts\n\u003c/p\u003e\n\n\u003c!-- markdownlint-enable MD033 MD041 --\u003e\n\n---\n\n## Overview\n\n**Security Guardrails** is a [reusable GitHub Actions\nworkflow](https://docs.github.com/en/actions/using-workflows/reusing-workflows)\nthat runs on pull requests in consumer repositories. It focuses on **changed\nfiles and dependencies**, surfaces **high-confidence findings**, and uploads\nmachine-readable results (JSON / CycloneDX) for downstream tooling.\n\n| Job                      | Tool                                                               | What it catches                                                                      |\n| ------------------------ | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------ |\n| **OpenGrep – SAST**      | [OpenGrep](https://opengrep.dev/)                                  | ERROR-severity security patterns (`p/security-audit`, `p/owasp-top-ten`) in PR diffs |\n| **TruffleHog – Secrets** | [TruffleHog](https://github.com/trufflesecurity/trufflehog)        | **Verified** credentials only (`--results=verified`), JSON output                    |\n| **Supply Chain**         | Dependency Review + [Trivy](https://github.com/aquasecurity/trivy) | New vulnerable deps, CRITICAL/HIGH CVEs, forbidden copyleft licenses, CycloneDX SBOM |\n\n## Quick start\n\nAdd a workflow in your repository (e.g. `.github/workflows/security-guardrails.yaml`):\n\n```yaml\nname: 'Security Guardrails'\n\non: pull_request\n\njobs:\n  security-guardrails:\n    uses: garretpatten/security-guardrails/.github/workflows/security-guardrails.yaml@master\n    with:\n      opengrep_run: true\n      trufflehog_run: true\n      supply_chain_run: true\n    secrets: inherit\n```\n\n**Pin a commit SHA** instead of `@master` for supply-chain control:\n\n```yaml\nuses: garretpatten/security-guardrails/.github/workflows/security-guardrails.yaml@\u003cfull-commit-sha\u003e\n```\n\n## Workflow inputs\n\n| Input              | Type    | Default         | Description                                      |\n| ------------------ | ------- | --------------- | ------------------------------------------------ |\n| `opengrep_run`     | boolean | `true`          | Run OpenGrep static analysis on changed files    |\n| `trufflehog_run`   | boolean | `true`          | Run TruffleHog secret scanning on the PR diff    |\n| `supply_chain_run` | boolean | `true`          | Dependency review, Trivy vuln/license scan, SBOM |\n| `opengrep_version` | string  | `v1.22.0`       | Pinned OpenGrep release tag                      |\n| `trivy_severity`   | string  | `CRITICAL,HIGH` | Minimum Trivy vulnerability severities           |\n\nDependabot PRs are skipped automatically.\n\n## Scanners\n\n### OpenGrep (SAST)\n\n[OpenGrep](https://github.com/opengrep/opengrep) is an open-source fork of\nSemgrep CE with compatible rules and SARIF/JSON output. The workflow:\n\n- Installs a **pinned release** via the official install script\n- Scans only **files changed in the PR**\n- Uses rulesets `p/security-audit` and `p/owasp-top-ten`\n- Fails only on **`ERROR` severity** findings to reduce noise\n- Uploads `opengrep-results.json` as a workflow artifact\n\n### TruffleHog (secrets)\n\n- Scans the PR diff (`base` → `HEAD`)\n- **`--results=verified`** — only secrets confirmed live by provider APIs\n- **`--json`** — structured output uploaded as an artifact\n- Respects **`.truffleignore`** in the consumer repository\n\n### Supply chain\n\n1. **GitHub Dependency Review** — blocks PRs that introduce dependencies with\n   **high-severity** advisories or **forbidden licenses** (GPL, AGPL, SSPL,\n   BUSL, and related identifiers).\n2. **Trivy filesystem scan** — CRITICAL/HIGH CVEs in lockfiles/manifests;\n   **`ignore-unfixed: true`** avoids failing on issues with no patch.\n3. **Trivy license audit** — flags **HIGH-severity (forbidden/copyleft)**\n   licenses with full license text matching.\n4. **CycloneDX SBOM** — `sbom.cyclonedx.json` uploaded per PR for audit and\n   compliance pipelines.\n\nAdd a **`.trivyignore`** in your repo to exclude paths (see this repo’s\nexample).\n\n## Migration\n\n### Renamed from `security-checks`\n\nThis project was renamed **Security Guardrails** (`security-guardrails`). Update\nconsumer workflows:\n\n```yaml\n# Before\nuses: garretpatten/security-checks/.github/workflows/security-checks.yaml@master\n\n# After\nuses: garretpatten/security-guardrails/.github/workflows/security-guardrails.yaml@master\n```\n\n### From Semgrep\n\nThe **`semgrep_run`** input was replaced by **`opengrep_run`**. OpenGrep uses\nthe same registry rulesets and is a drop-in engine swap for Semgrep CE scans.\n\n```yaml\n# Before\nwith:\n  semgrep_run: true\n\n# After\nwith:\n  opengrep_run: true\n  supply_chain_run: true   # disable if you only want SAST + secrets\n```\n\n## Philosophy: high signal, low noise\n\n| Choice                         | Rationale                                                 |\n| ------------------------------ | --------------------------------------------------------- |\n| ERROR-only OpenGrep            | Warnings often reflect style or lower-confidence patterns |\n| Verified TruffleHog only       | Unverified entropy matches create alert fatigue           |\n| CRITICAL/HIGH + ignore-unfixed | Focus on exploitable, patchable CVEs                      |\n| Forbidden license list         | Surfaces copyleft / business-risk licenses in new deps    |\n| PR-scoped SAST                 | Faster feedback; aligns with code under review            |\n\n## Community\n\n| Resource                                | Use                                           |\n| --------------------------------------- | --------------------------------------------- |\n| [Code of Conduct](./CODE_OF_CONDUCT.md) | Expected behavior in issues and PRs           |\n| [Contributing](./CONTRIBUTING.md)       | Branching, local checks, workflow conventions |\n| [Security policy](./SECURITY.md)        | Vulnerability reporting (not public issues)   |\n\n## Maintainers\n\n[@garretpatten](https://github.com/garretpatten/)\n\nUse the [issue templates](./.github/ISSUE_TEMPLATE/) for bugs and enhancements.\n\n## License\n\nThis project is licensed under the [MIT License](./LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgarretpatten%2Fsecurity-guardrails","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgarretpatten%2Fsecurity-guardrails","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgarretpatten%2Fsecurity-guardrails/lists"}