Shift Left Security: 4 Automated Security Gates in GitHub Actions

The article discusses the importance of implementing automated security gates in GitHub Actions to prevent vulnerabilities from making it into production. The author shares a personal experience of a prototype pollution vulnerability in an npm package that took two days to review internally, despite being a known CVE in the NVD for months. The article highlights four automated security gates that can be wired into GitHub Actions, which run on every push and pull request without requiring an enterprise license.

Gate 1: Dependency scanning with Npm Audit and Snyk is the first automated security gate discussed. It finds CVEs in npm packages before they are shipped. Npm audit catches vulnerabilities that Node.js is aware of, while Snyk provides additional information such as upgrade paths for vulnerabilities that it catches. The author provides a sample workflow in .github/workflows/gate-1-dependency-scan.yml to set up Gate 1.

Gate 2: Container image scanning with Trivy is the second automated security gate. It finds CVEs in Docker base image OS packages. The author explains that dependency scanning only looks at npm packages, and container image scanning is necessary to check the entire container image for vulnerabilities in OS packages, language packages, and configuration issues. The sample workflow in .github/workflows/gate-2-image-scan.yml is provided to set up Gate 2.

Gate 3: Static analysis (SAST) with CodeQL is the third automated security gate. It finds code-level vulnerabilities such as SQL injection and hardcoded secrets. CodeQL runs free on public repositories, so no paid GitHub plan is needed. The sample workflow to set up Gate 3 is not provided in the article.

Gate 4: Dynamic scanning (DAST) with OWASP ZAP Baseline is the fourth and final automated security gate. It finds runtime vulnerabilities in a running instance of the app. This gate only starts after all three previous gates have passed. The author explains that the sample app used in the article is an Express API with a Dockerfile and docker-compose.yml, and the full code is available on GitHub at github-actions-security-gates.

The article emphasizes the importance of addressing the cost gap between fixing vulnerabilities in CI and production. It states that a vulnerability caught in CI costs about $80 to fix, while the same vulnerability caught in production can cost $7,600. The article concludes by stating that implementing these four automated security gates wired into GitHub Actions can help teams catch vulnerabilities early in the development process, saving time and money.