Skip to content

Add GitHub Action: Qwiet AI by Harness Static Analysis #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LCSOGthb wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add GitHub Action: Qwiet AI by Harness Static Analysis #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3b2b5f2
adding ShiftLeft action workflow config
Jul 26, 2026
4b42fd2
adding Qwiet AI by Harness Static Analysis action workflow config
Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 62 additions & 0 deletions .github/workflows/shiftleft.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
---

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: This workflow does not declare a permissions block, so the GITHUB_TOKEN receives the repository's default permissions (often broad write access). Add a top-level permissions block to follow the principle of least privilege. A minimal starting point for this workflow would be:

permissions:
  contents: read
Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 6:

<comment>This workflow does not declare a `permissions` block, so the `GITHUB_TOKEN` receives the repository's default permissions (often broad write access). Add a top-level `permissions` block to follow the principle of least privilege. A minimal starting point for this workflow would be:

```yaml
permissions:
  contents: read
```</comment>

<file context>
@@ -0,0 +1,62 @@
+# Visit https://docs.shiftleft.io for help
+name: Harness SAST and SCA
+
+on:
+  pull_request:
+  workflow_dispatch:
</file context>

# This workflow integrates Harness SAST and SCA with GitHub
# Visit https://docs.shiftleft.io for help
name: Harness SAST and SCA

on:
pull_request:
workflow_dispatch:

jobs:
NextGen-Static-Analysis:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3

@qltysh qltysh Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 2 issues:

1. credential persistence through GitHub Actions artifacts [zizmor:zizmor/artipacked]


2. the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue [actionlint:action]

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: actions/checkout@v3 is inconsistent with the rest of the repo — all other workflows use @v4. The v3 tag runs on Node 16 (deprecated by GitHub Actions) and will produce deprecation warnings. Upgrade to actions/checkout@v4 for consistency and to avoid runtime warnings.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 14:

<comment>actions/checkout@v3 is inconsistent with the rest of the repo — all other workflows use @v4. The v3 tag runs on Node 16 (deprecated by GitHub Actions) and will produce deprecation warnings. Upgrade to actions/checkout@v4 for consistency and to avoid runtime warnings.</comment>

<file context>
@@ -0,0 +1,62 @@
+  NextGen-Static-Analysis:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup Java JDK v11
+      uses: actions/setup-java@v3
</file context>
Suggested change
- uses: actions/checkout@v3
- uses: actions/checkout@v4

- name: Setup Java JDK v11
uses: actions/setup-java@v3

@qltysh qltysh Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue [actionlint:action]

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: actions/setup-java@v3 runs on Node 16 which is deprecated by GitHub Actions. Upgrade to @v4 to use Node 20 and avoid deprecation warnings. The distribution and java-version parameters remain the same.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 16:

<comment>actions/setup-java@v3 runs on Node 16 which is deprecated by GitHub Actions. Upgrade to @v4 to use Node 20 and avoid deprecation warnings. The distribution and java-version parameters remain the same.</comment>

<file context>
@@ -0,0 +1,62 @@
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup Java JDK v11
+      uses: actions/setup-java@v3
+      with:
+        distribution: zulu
</file context>

with:
distribution: zulu
java-version: 11

- name: Download Harness SAST and SCA CLI
run: |
curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl

- name: Static Analysis

Check failure on line 25 in .github/workflows/shiftleft.yml

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

.github/workflows/shiftleft.yml#L25 

Ensure run commands are not vulnerable to shell injection
run: |

Check failure on line 26 in .github/workflows/shiftleft.yml

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

.github/workflows/shiftleft.yml#L26 

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner.

@qltysh qltysh Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs\.github\.com/en/actions/reference/security/secure\-use\#good\-practices\-for\-mitigating\-script\-injection\-attacks for more details [actionlint:expression]

${GITHUB_WORKSPACE}/sl --version
${GITHUB_WORKSPACE}/sl analyze --strict --wait \
--app Center \
--tag branch=${{ github.head_ref }} \

@qltysh qltysh Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

code injection via template expansion [zizmor:zizmor/template-injection]

@sentry sentry Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The github.head_ref variable is empty on workflow_dispatch triggers, resulting in an empty branch tag (--tag branch=) for the ShiftLeft analysis.
Severity: MEDIUM

Suggested Fix

Provide a fallback value for the branch tag when github.head_ref is empty. For example, you can use github.ref_name, which is available on workflow_dispatch events. The expression could be branch=${{ github.head_ref || github.ref_name }}.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .github/workflows/shiftleft.yml#L30

Potential issue: When the GitHub Actions workflow is triggered manually via
`workflow_dispatch`, the `github.head_ref` context variable is an empty string. This
causes the command on line 30 to pass an empty value to the `--tag branch=` argument.
This will either cause the workflow to fail due to the `--strict` flag, or it will
upload the analysis with an empty branch tag, making it difficult to identify and track
in the ShiftLeft dashboard.

Did we get this right? 👍 / 👎 to inform future reviews.

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Using ${{ github.head_ref }} directly in a run block is a script injection risk. An attacker can craft a branch name containing shell metacharacters (e.g., '; malicious-command #) that will be interpolated into the script before execution. Pass it through an environment variable instead:

env:
  BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
run: |
  ... --tag branch=${BRANCH_NAME} ...
Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:

<comment>Using `${{ github.head_ref }}` directly in a `run` block is a script injection risk. An attacker can craft a branch name containing shell metacharacters (e.g., `'; malicious-command #`) that will be interpolated into the script before execution. Pass it through an environment variable instead:

```yaml
env:
  BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
run: |
  ... --tag branch=${BRANCH_NAME} ...
```</comment>

<file context>
@@ -0,0 +1,62 @@
+        ${GITHUB_WORKSPACE}/sl --version
+        ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+          --app Center \
+          --tag branch=${{ github.head_ref }} \
+          --jssrc .
+      env:
</file context>

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: github.head_ref is only populated for pull_request and pull_request_target events. Since this workflow also triggers on workflow_dispatch, the --tag branch= argument will receive an empty string, which may cause the --strict flag to fail or produce an untagged analysis. Use a fallback like ${{ github.head_ref || github.ref_name }} to handle non-PR triggers.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:

<comment>`github.head_ref` is only populated for `pull_request` and `pull_request_target` events. Since this workflow also triggers on `workflow_dispatch`, the `--tag branch=` argument will receive an empty string, which may cause the `--strict` flag to fail or produce an untagged analysis. Use a fallback like `${{ github.head_ref || github.ref_name }}` to handle non-PR triggers.</comment>

<file context>
@@ -0,0 +1,62 @@
+        ${GITHUB_WORKSPACE}/sl --version
+        ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+          --app Center \
+          --tag branch=${{ github.head_ref }} \
+          --jssrc .
+      env:
</file context>

--jssrc .
env:
SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
SHIFTLEFT_API_HOST: www.shiftleft.io
SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443
SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443

# Build-Rules:
# runs-on: ubuntu-latest
# permissions: write-all

Check warning on line 40 in .github/workflows/shiftleft.yml

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

.github/workflows/shiftleft.yml#L40 

Ensure top-level permissions are not set to write-all
# needs: NextGen-Static-Analysis
# steps:
# - uses: actions/checkout@v3
# - name: Download Harness SAST and SCA CLI
# run: |
# curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl
# - name: Validate Build Rules
# run: |
# ${GITHUB_WORKSPACE}/sl check-analysis --app Center \
# --github-pr-number=${{github.event.number}} \
# --github-pr-user=${{ github.repository_owner }} \
# --github-pr-repo=${{ github.event.repository.name }} \
# --github-token=${{ secrets.GITHUB_TOKEN }}
# env:
# # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
#
# SHIFTLEFT_API_HOST: www.shiftleft.io
# SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443
# SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443
#
Comment on lines +12 to +60


@qltysh qltysh Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

overly broad permissions [zizmor:zizmor/excessive-permissions]

15 changes: 15 additions & 0 deletions shiftleft.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
version: 2
build_rules:
- id: Allow no critical findings
severities:
- critical
- id: Allow one OSS or container finding
finding_types:
- oss_vuln
- container
threshold: 1
- id: Allow no reachable OSS vulnerability
finding_types:
- oss_vuln
options:
reachable: true
Loading