GitHub Actions Security Scanning Pipeline
Combines Trivy (containers and Terraform IaC), Semgrep, and OWASP dependency check in one workflow. Results posted as PR annotations.
Comprehensive Security Scanning Workflow
A single GitHub Actions workflow that runs four complementary security scanners on every PR — covering container vulnerabilities, Terraform misconfigurations, source code weaknesses, and dependency issues — with results posted as inline PR annotations.
What's Included
- Trivy — container image vulnerability scanning (CRITICAL/HIGH threshold configurable)
- Trivy IaC — Terraform misconfiguration analysis for security misconfigurations
- Semgrep — SAST scanning for common code vulnerabilities
- OWASP Dependency Check — CVE scanning for third-party packages
- All results surfaced as PR review annotations and job summaries
What You Get
security-scan.yml— drop into.github/workflows/- Semgrep ruleset configuration tuned to reduce noise
- SARIF upload configuration for GitHub Security tab integration
README.md— tuning guide and threshold customization
Requirements
- GitHub repository with Actions enabled
- No additional secrets required for basic scanning
- Semgrep token optional (enables additional rulesets)