From ba83b056e3891b75d8ebb09369f988d891d300e4 Mon Sep 17 00:00:00 2001
From: Advait Patel <advaitpa93@gmail.com>
Date: Mon, 21 Sep 2026 02:02:15 -0500
Subject: [PATCH 1/2] ci: add DockSec container scan with SARIF upload

Scans the Dockerfile with DockSec and uploads the results to code scanning
as SARIF, so container findings are annotated on pull requests.

Runs scan-only, so no API key is required and no gate is added to the build.
All actions are pinned to a commit SHA.

Signed-off-by: Advait Patel <advaitpa93@gmail.com>
---
 .github/workflows/docksec.yml | 46 +++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/docksec.yml

diff --git a/.github/workflows/docksec.yml b/.github/workflows/docksec.yml
new file mode 100644
index 0000000000..632a1603e7
--- /dev/null
+++ b/.github/workflows/docksec.yml
@@ -0,0 +1,46 @@
+name: DockSec
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - '**/Dockerfile*'
+      - '**/Containerfile*'
+      - '.github/workflows/docksec.yml'
+  pull_request:
+    paths:
+      - '**/Dockerfile*'
+      - '**/Containerfile*'
+      - '.github/workflows/docksec.yml'
+  schedule:
+    - cron: '0 6 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: Scan Dockerfile
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Run DockSec
+        uses: OWASP/DockSec@d52c8e928552dc39003abda21ac6bc4662b06c39 # v2026.9.21
+        with:
+          dockerfile: Dockerfile
+          scan_only: 'true'
+          sarif: 'true'
+          output_dir: ${{ github.workspace }}/docksec-results
+
+      - name: Upload SARIF to Code Scanning
+        uses: github/codeql-action/upload-sarif@3ea06614dafe36dec890db3446326e0d40ce53d4 # v3
+        if: always()
+        with:
+          sarif_file: docksec-results
+          category: docksec

From 78ee3ae3be67cd77f338d81ecc12c27e1ef03ff1 Mon Sep 17 00:00:00 2001
From: Advait Patel <advaitpa93@gmail.com>
Date: Mon, 21 Sep 2026 12:04:18 -0500
Subject: [PATCH 2/2] ci: fix Dockerfile path binding, credential persistence,
 and fork SARIF upload

The path filter matched nested Dockerfile/Containerfile variants but the scan
itself only ever reads the root Dockerfile, so a change to a nested file would
trigger a green run that scanned nothing relevant - worse than no scan, since
it reads as coverage that isn't there. Narrowed the trigger to match what is
actually scanned.

checkout now sets persist-credentials: false; nothing after it needs the token
in git config, and the next step runs third-party actions.

The SARIF upload no longer runs unconditionally on fork pull requests. GITHUB_TOKEN
is read-only there, so security-events: write cannot apply and the upload would
fail every time - turning a routine fork contribution into a red required check.
It now runs on push, on same-repo PRs, and on schedule, and is skipped on fork PRs.

Thanks to a reviewer on an earlier PR for catching all three.

Signed-off-by: Advait Patel <advaitpa93@gmail.com>
---
 .github/workflows/docksec.yml | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/docksec.yml b/.github/workflows/docksec.yml
index 632a1603e7..a2c8531c2c 100644
--- a/.github/workflows/docksec.yml
+++ b/.github/workflows/docksec.yml
@@ -4,13 +4,13 @@ on:
   push:
     branches: [main]
     paths:
-      - '**/Dockerfile*'
-      - '**/Containerfile*'
+      - 'Dockerfile'
+      - 'Containerfile'
       - '.github/workflows/docksec.yml'
   pull_request:
     paths:
-      - '**/Dockerfile*'
-      - '**/Containerfile*'
+      - 'Dockerfile'
+      - 'Containerfile'
       - '.github/workflows/docksec.yml'
   schedule:
     - cron: '0 6 * * 1'
@@ -29,6 +29,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
 
       - name: Run DockSec
         uses: OWASP/DockSec@d52c8e928552dc39003abda21ac6bc4662b06c39 # v2026.9.21
@@ -39,8 +41,11 @@ jobs:
           output_dir: ${{ github.workspace }}/docksec-results
 
       - name: Upload SARIF to Code Scanning
+        # Not `if: always()`: on a fork pull_request, GITHUB_TOKEN is read-only and this
+        # upload would fail every time, turning a routine fork contribution into a red
+        # required check. Skip it there instead of forcing a failure.
+        if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
         uses: github/codeql-action/upload-sarif@3ea06614dafe36dec890db3446326e0d40ce53d4 # v3
-        if: always()
         with:
           sarif_file: docksec-results
           category: docksec