Repository navigation
ci(secu): run security scans on Ubuntu 26.04 - #76
Merged
Merged
Conversation
Move the reusable security workflows to the Ubuntu 26.04 runners: private centreon repositories use centreon-ubuntu-26.04-small (secret scan) and centreon-ubuntu-26.04-slim (dependency scan), public ones ubuntu-26.04. The quanta-computing runner (quanta-security) is kept. Refs: SECU-1249 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Assisted-by: Claude Code (claude-opus-5-5)
Some runners (centreon-ubuntu-26.04-small) already ship gitleaks. Keep it when `gitleaks version` reports the pinned GITLEAKS_VERSION, and install the pinned release, verified against GITLEAKS_SHA256, in every other case: gitleaks missing (e.g. the public ubuntu-26.04 runner) or any other version. Refs: SECU-1249 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Assisted-by: Claude Code (claude-opus-5-5)
Use the rule of the centreon-ubuntu-26.04 runner images (centreon-images, runners/base-ubuntu-26.04/Dockerfile), so the private runner's preinstalled gitleaks is the expected one and gets reused: GITLEAKS_VERSION "latest" is the newest stable release published at least 4 days before the run, and a version can still be pinned. When the runner's gitleaks differs, the release for the runner's architecture is installed and verified against its checksums file. The GitHub API is called with the job token, passed through curl's config on stdin, to avoid the anonymous rate limit shared behind an egress IP. Refs: SECU-1249 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Assisted-by: Claude Code (claude-opus-5-5)
The latest-release lookup sent the job token to the GitHub API only to lift the anonymous rate limit. Read the public releases feed instead: it needs no token and no API quota, and its <updated> date is at or after the publication date, so the 4-day delay still holds. Drafts are not in the feed and only vX.Y.Z tags are kept. jq is no longer needed. Refs: SECU-1249 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Assisted-by: Claude Code (claude-opus-5-5)
An unreachable releases feed failed the job, blocking every pull request of the org. Install GITLEAKS_FALLBACK_VERSION (8.30.1) instead, still verified against its checksums file, and emit a gitleaks-version-fallback warning so the issue can be found and investigated. Refs: SECU-1249 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Assisted-by: Claude Code (claude-opus-5-5)
Signed-off-by: Stéphane Chapron <34628915+sc979@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
What are your needs or what are you planning to do in this PR?
Move the reusable security workflows to the Ubuntu 26.04 runners, and install gitleaks the same way as the
centreon-ubuntu-26.04runner images, so the private runner's preinstalled gitleaks is reused.Stacked on #64: this PR targets
SECU-gitleaks-customand will be retargeted tomainonce #64 is merged.Runners
centreonreposgitleaks-analysis.ymlcentreon-security→centreon-ubuntu-26.04-smallubuntu-24.04→ubuntu-26.04dependency-analysis.ymlcentreon-security→centreon-ubuntu-26.04-slimubuntu-24.04→ubuntu-26.04The
quanta-computingrunner (quanta-security) is kept. Apart from thecentreonlabel, both expressions stay in sync.gitleaks install
Same rule as
runners/base-ubuntu-26.04/Dockerfilein centreon-images (#390):GITLEAKS_VERSION: "latest"is the newestvX.Y.Zrelease published at least 4 days before the run. It is read from the public releases feed (releases.atom): no token, no GitHub API call. A version can still be pinned.GITLEAKS_FALLBACK_VERSION(8.30.1) is used, with agitleaks-version-fallbackwarning, so the run is not blocked.gitleaks versionmatches, the runner's binary is kept (expected oncentreon-ubuntu-26.04-small). Otherwise the release for the runner's architecture (x64/arm64) is installed and verified against the release's checksums file. A checksum mismatch fails the job.The pinned
GITLEAKS_SHA256is removed: integrity now relies on the release's checksums file, with the 4-day delay, as in the runner images.New runner requirements for the install step:
curl,python3, GNUdate,sha256sum,tar(present onubuntu-26.04and thecentreon-ubuntu-26.04images; to check onquanta-security).Tests
Workflow steps extracted verbatim and run against stubbed downloads and an authenticated local git remote: 131 / 131 passed, including the whole #64 suite (no regression on the scan ranges) and the install cases: runner binary kept / replaced, latest resolution (pre-release tags and releases under 4 days skipped), pinned version, feed fallback, checksum mismatch, missing checksums file,
arm64, no token sent. The feed parser also returns8.30.1on the real feed.To validate
Call both workflows from this branch (
@SECU-1249-ubuntu-26-04-runners) on a private repository (self-hosted runner) and on a public one (ubuntu-26.04).🤖 Generated with Claude Code