feat: add RapiDAST DAST scanning workflow#1997
Conversation
Add GitHub Actions workflow for automated DAST scanning using RapiDAST: - ZAP spider + passive + active scan on the metrics endpoint (port 8443) - oobtkube blind command injection scan on BpfApplication CRDs - Weekly schedule + manual trigger - SARIF artifact upload and step summary reporting Scan configs externalised in .github/rapidast/ for maintainability. Reuses existing Kind cluster setup from integration tests. Co-authored-by: Cursor <cursoragent@cursor.com>
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
WalkthroughAdds a ChangesRapiDAST DAST Scan Workflow
Sequence Diagram(s)sequenceDiagram
participant Trigger as Cron / manual dispatch
participant Job as rapidast-dast-scan
participant Kind as Kind cluster
participant kubectl
participant RapiDAST as RapiDAST container
Trigger->>Job: start workflow
Job->>Kind: build + deploy bpfman-operator images
Kind-->>Job: controller-manager + daemonset ready
rect rgba(70, 130, 180, 0.5)
Note over Job,RapiDAST: ZAP scan
Job->>kubectl: port-forward metrics service
Job->>kubectl: create SA token → AUTH_TOKEN
Job->>RapiDAST: run with zap-config.yaml
RapiDAST-->>Job: ZAP json/html/sarif reports
Job->>kubectl: stop port-forward (always)
end
rect rgba(180, 100, 70, 0.5)
Note over Job,RapiDAST: OOBKube scan
Job->>kubectl: apply BpfApplication CR
Job->>kubectl: get operator pod IP → POD_IP
Job->>RapiDAST: run with oobtkube-config.yaml + CR
RapiDAST-->>Job: oobtkube SARIF report
end
Job->>Job: upload artifacts + write step summary
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mpapadopoullos The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @mpapadopoullos. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
added
the
needs-ok-to-test
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/rapidast.yml (1)
8-180:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy liftAdd SAST/SCA coverage to this pipeline (or invoke an existing reusable job).
This workflow currently runs DAST only; there are no SAST/SCA steps in the pipeline definition.
As per coding guidelines,
.github/workflows/**/*: "SAST/SCA steps in pipeline".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/rapidast.yml around lines 8 - 180, The rapidast-dast-scan job currently only performs DAST scanning using RapiDAST but lacks SAST and SCA coverage as required by coding guidelines. Add SAST (Static Application Security Testing) and SCA (Software Composition Analysis) steps to the workflow by either invoking an existing reusable job or by adding new steps that scan the codebase for static vulnerabilities and dependency issues. These steps should be placed alongside the existing DAST scanning steps in the job definition.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/rapidast.yml:
- Around line 131-146: The "Upload ZAP scan results" and "Upload oobtkube scan
results" steps are uploading artifacts without signing them, making it
impossible for downstream consumers to verify provenance and integrity. Add a
signing step before each upload-artifact action that uses Sigstore/cosign to
sign the artifacts from /tmp/rapidast-results/zap/ and
/tmp/rapidast-results/oobtkube/ respectively, then configure the upload-artifact
actions to include the generated signatures. This ensures artifacts can be
verified by consumers.
- Around line 8-15: The rapidast-dast-scan job lacks an explicit permissions
block, causing the GITHUB_TOKEN to have default scopes that are broader than
necessary. Add a permissions block at the job level (as a sibling to the name,
runs-on, env, and steps fields) that explicitly defines only the minimal
required permissions needed for the RapiDAST Security Scan job to run. This
ensures the GITHUB_TOKEN follows the principle of least privilege by restricting
access to only what is strictly necessary for this workflow to function.
- Around line 24-28: The actions/checkout@v6 action in the "Checkout
bpfman-operator" step is currently persisting credentials in the local git
config, which creates unnecessary token exposure. Add the persist-credentials
parameter set to false in the with block of the checkout action to disable
credential persistence and comply with the least privilege principle for
GITHUB_TOKEN permissions.
- Around line 25-26: Replace all mutable GitHub Actions version tags with their
corresponding full commit SHAs in the rapidast.yml workflow file to ensure
supply chain immutability. Update actions/checkout from `@v6`, actions/setup-go
from `@v6`, actions/cache from `@v5`, and actions/upload-artifact from `@v6` by
replacing each mutable tag with the full commit SHA provided in the comment.
This prevents these actions from being re-released with breaking or malicious
changes without explicit consent.
---
Outside diff comments:
In @.github/workflows/rapidast.yml:
- Around line 8-180: The rapidast-dast-scan job currently only performs DAST
scanning using RapiDAST but lacks SAST and SCA coverage as required by coding
guidelines. Add SAST (Static Application Security Testing) and SCA (Software
Composition Analysis) steps to the workflow by either invoking an existing
reusable job or by adding new steps that scan the codebase for static
vulnerabilities and dependency issues. These steps should be placed alongside
the existing DAST scanning steps in the job definition.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 22542bf0-bdff-4978-8d05-96246b058301
📒 Files selected for processing (4)
.github/rapidast/bpfapplication-oobtkube-cr.yaml.github/rapidast/oobtkube-config.yaml.github/rapidast/zap-config.yaml.github/workflows/rapidast.yml
| jobs: | ||
| rapidast-dast-scan: | ||
| name: RapiDAST Security Scan | ||
| runs-on: ubuntu-24.04 | ||
| env: | ||
| BPFMAN_AGENT_IMG: quay.io/bpfman/bpfman-agent:int-test | ||
| BPFMAN_OPERATOR_IMG: quay.io/bpfman/bpfman-operator:int-test | ||
| steps: |
There was a problem hiding this comment.
Define explicit least-privilege GITHUB_TOKEN permissions.
No permissions block is set, so token scopes default broader than necessary for this job.
Suggested hardening
name: RapiDAST DAST Scan
on:
workflow_dispatch:
schedule:
- cron: "0 0 * * 0" # Sunday midnight UTC
+permissions:
+ contents: read
+
jobs:
rapidast-dast-scan:
name: RapiDAST Security ScanAs per coding guidelines, .github/workflows/**/*: "Least privilege: minimize GITHUB_TOKEN permissions".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/rapidast.yml around lines 8 - 15, The rapidast-dast-scan
job lacks an explicit permissions block, causing the GITHUB_TOKEN to have
default scopes that are broader than necessary. Add a permissions block at the
job level (as a sibling to the name, runs-on, env, and steps fields) that
explicitly defines only the minimal required permissions needed for the RapiDAST
Security Scan job to run. This ensures the GITHUB_TOKEN follows the principle of
least privilege by restricting access to only what is strictly necessary for
this workflow to function.
Source: Coding guidelines
| - name: Checkout bpfman-operator | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
There was a problem hiding this comment.
Disable checkout credential persistence.
actions/checkout currently persists credentials in local git config. This is avoidable token exposure in a multi-step job.
Suggested hardening
- name: Checkout bpfman-operator
uses: actions/checkout@v6
with:
fetch-depth: 0
+ persist-credentials: falseAs per coding guidelines, .github/workflows/**/*: "Least privilege: minimize GITHUB_TOKEN permissions".
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 24-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/rapidast.yml around lines 24 - 28, The actions/checkout@v6
action in the "Checkout bpfman-operator" step is currently persisting
credentials in the local git config, which creates unnecessary token exposure.
Add the persist-credentials parameter set to false in the with block of the
checkout action to disable credential persistence and comply with the least
privilege principle for GITHUB_TOKEN permissions.
Sources: Coding guidelines, Linters/SAST tools
| uses: actions/checkout@v6 | ||
| with: |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
fd -type f -name "rapidast.yml" .github/Repository: openshift/bpfman-operator
Length of output: 240
🏁 Script executed:
fd -t f -name "rapidast.yml" .github/Repository: openshift/bpfman-operator
Length of output: 300
🏁 Script executed:
fd "rapidast.yml" .github/Repository: openshift/bpfman-operator
Length of output: 100
🏁 Script executed:
cat -n .github/workflows/rapidast.yml | head -150Repository: openshift/bpfman-operator
Length of output: 6164
🏁 Script executed:
cat -n .github/workflows/rapidast.yml | tail -20Repository: openshift/bpfman-operator
Length of output: 920
🏁 Script executed:
rg 'uses:' .github/workflows/rapidast.ymlRepository: openshift/bpfman-operator
Length of output: 281
Pin all GitHub Actions to full commit SHAs.
Lines 25, 30, 36, 44, 133, and 141 use mutable tags (@v5, @v6), which breaks immutability guarantees for the CI supply chain. Actions with mutable tags can be re-released with breaking or malicious changes without explicit consent.
Replace all action tags with full commit SHAs:
actions/checkout@v6→actions/checkout@eace6...(current v6 SHA)actions/setup-go@v6→actions/setup-go@0c52d...(current v6 SHA)actions/cache@v5→actions/cache@0c45773...(current v5 SHA)actions/upload-artifact@v6→actions/upload-artifact@83fd05...(current v6 SHA)
🧰 Tools
🪛 zizmor (1.25.2)
[error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/rapidast.yml around lines 25 - 26, Replace all mutable
GitHub Actions version tags with their corresponding full commit SHAs in the
rapidast.yml workflow file to ensure supply chain immutability. Update
actions/checkout from `@v6`, actions/setup-go from `@v6`, actions/cache from `@v5`,
and actions/upload-artifact from `@v6` by replacing each mutable tag with the full
commit SHA provided in the comment. This prevents these actions from being
re-released with breaking or malicious changes without explicit consent.
Sources: Coding guidelines, Linters/SAST tools
| - name: Upload ZAP scan results | ||
| if: always() | ||
| uses: actions/upload-artifact@v6 | ||
| with: | ||
| name: rapidast-zap-results | ||
| path: /tmp/rapidast-results/zap/ | ||
| if-no-files-found: warn | ||
|
|
||
| - name: Upload oobtkube scan results | ||
| if: always() | ||
| uses: actions/upload-artifact@v6 | ||
| with: | ||
| name: rapidast-oobtkube-results | ||
| path: /tmp/rapidast-results/oobtkube/ | ||
| if-no-files-found: warn | ||
|
|
There was a problem hiding this comment.
Sign scan artifacts before upload (Sigstore/cosign).
Artifacts are uploaded unsigned, so downstream consumers cannot verify provenance/integrity.
As per coding guidelines, .github/workflows/**/*: "Sign artifacts with Sigstore/cosign".
🧰 Tools
🪛 zizmor (1.25.2)
[error] 133-133: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 141-141: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/rapidast.yml around lines 131 - 146, The "Upload ZAP scan
results" and "Upload oobtkube scan results" steps are uploading artifacts
without signing them, making it impossible for downstream consumers to verify
provenance and integrity. Add a signing step before each upload-artifact action
that uses Sigstore/cosign to sign the artifacts from /tmp/rapidast-results/zap/
and /tmp/rapidast-results/oobtkube/ respectively, then configure the
upload-artifact actions to include the generated signatures. This ensures
artifacts can be verified by consumers.
Source: Coding guidelines
|
/ok-to-test |
openshift-ci
Bot
added
ok-to-test
2 participants
Summary
.github/workflows/rapidast.yml) for automated DAST scanning using RapiDAST/metricson port 8443) with SA token authworkflow_dispatchtriggerDesign decisions
make run-on-kind) from integration testsdevelopmentimage tag (notlatest, which is known-broken)--network hostfor RapiDAST containers to reach port-forwarded servicescontinue-on-error: trueon scan steps so artifacts always upload.github/rapidast/for maintainabilityFiles
.github/workflows/rapidast.yml.github/rapidast/zap-config.yaml.github/rapidast/oobtkube-config.yaml.github/rapidast/bpfapplication-oobtkube-cr.yamlTest plan
workflow_dispatchMade with Cursor
Summary by CodeRabbit