sabinghost19/Security Scan Attestor
Aggregate gitleaks (secrets), Semgrep (SAST) and checkov (IaC) results into a signed security-scan Cosign attestation
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| image | Immutable image reference in digest form (ghcr.io/...@sha256:...) | yes | — |
| commit-sha | Git commit SHA associated with the build | yes | — |
| service | Service name for multi-image apps (api | worker); empty for single-image apps | no | "" |
| gitleaks-report | Path to the gitleaks JSON report (secrets) | no | "" |
| semgrep-sarif | Path to the Semgrep SARIF report (SAST) | no | "" |
| checkov-sarif | Path to the checkov SARIF report (IaC: Dockerfile + K8s manifests) | no | "" |
| sast-block-severity | Minimum SAST severity that CI considers blocking (low|medium|high|critical). Recorded in gating; enforcement is upstream/operator. | no | critical |
| attestation-type | Cosign attestation type (predicate type URI) | no | https://devsecops.licenta.ro/attestations/security-scan/v1 |
Outputs
| name | description |
|---|---|
| predicate-path | Path to the generated security-scan predicate JSON file |
| result | CI gating verdict computed from the reports (pass|fail) |
| secrets-total | Total number of secret findings |