sisakulint is a CI-Friendly static linter with SAST, semantic analysis for GitHub Actions. This great tool can automatically validate yaml files according to the guidelines in the security-related documentation provided by GitHub! It also includes functionality as a static analysis tool that can check the policies of the guidelines that should be set for use in each organization. These checks also comply with the Top 10 CI/CD Security Risks provided by OWASP. It implements most of the functions that can automatically check whether a workflow that meets the security features supported by github has been built to reduce the risk of malicious code being injected into the CI/CD pipeline or credentials such as tokens being stolen. It does not support inspections that cannot be expressed in YAML and “repository level settings” that can be set by GitHub organization administrators. It is intended to be used mainly by software developers and security personnel at user companies who work in blue teams. It is easy to introduce because it can be installed from brew. It also implements an autofix function for errors related to security features as a lint. It supports the SARIF format, which is the output format for static analysis. This allows reviewdog to provide a rich UI for error triage on GitHub.
4su_para
erikaheidi
mojombo
matthewcrist
swwweet
tammyeverts
lauravandoore
chrislema
mongodb
rmw
chriscoyier
eileencodes
