[glebedel]

What and why

Part of the Security Autopilot CI hardening pass. This repo already has .github/dependabot.yaml, already runs gitleaks in ci.yaml, and already SHA-pins every action, so this PR only adds the two missing scanners:

• osv-scanner (v2.7.0): scans the lockfiles for known vulnerable dependencies. Installed from the release binary, verified against a SHA-256 pinned in the workflow (OSV_SCANNER_SHA256, bumped together with the version) before use.
• zizmor (v1.31.1): audits the workflows for unsafe patterns such as template injection, excessive permissions and credential persistence. Run with pipx run zizmor==1.31.1.

The new .github/workflows/security-scan.yaml is report-only for now: both scanners write their output to the job summary and the job never fails on findings, because there is an existing backlog to triage first. A scanner that fails to run fails its job, so a broken scan is never shown as clean: osv-scanner exit codes 0 (clean), 1 (findings) and 128 (no packages) pass and any other code fails; zizmor runs with --no-exit-codes under set -e, so findings pass and tool errors fail. It runs on pull requests, pushes to main, weekly (Monday 05:23 UTC) and on manual dispatch. Top-level permissions: contents: read, checkout with persist-credentials: false, all actions pinned by SHA. No SARIF upload (code scanning is not available on this plan).

No dependabot, gitleaks, auto-merge or pinning changes.

Files

• .github/workflows/security-scan.yaml (new)

Verification

• actionlint 1.7.12: clean.
• zizmor 1.31.1 on the new file (regular and auditor personas): no findings.
• Ran the osv-scanner install step locally: the pinned hash matches both the release manifest and the downloaded binary; osv-scanner scan source -r --format markdown . produces a report for the lockfiles and exits 1 on findings, which the step accepts.
• The workflow runs on this PR; see the "Security scan" checks and their job summaries.

Requested by guillaume@stackone.com in Slack (Security Autopilot apply A+B+C)

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The workflow suppresses OSV scan failures and pipx/zizmor installation or execution errors, allowing checks to pass even when dependency or workflow auditing never completes.

2 open issues

• Report OSV scan failures instead of suppressing them · New
• Fail visibly when zizmor installation or execution fails · New

What changed in this PR

Adds report-only dependency and workflow security scanning alongside the existing gitleaks checks, without changing Dependabot or existing action pins.

Changes:

• Adds checksum-verified osv-scanner and version-pinned zizmor, with reports written to job summaries.
• Runs on pull requests, pushes to main, a weekly schedule, and manual dispatch.
• Uses read-only permissions and SHA-pinned checkout without persisted credentials.

File	Description
.github/​workflows/​security-scan.yml	Adds dependency and workflow scanning jobs with non-blocking findings and summary output.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the added report-only dependency and workflow security scans.

No open issues 🎉

2 resolved since last review

• Fail visibly when zizmor installation or execution fails
• Report OSV scan failures instead of suppressing them

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

There are no active review issues for the added dependency and workflow security scanning.

No open issues 🎉

_{Review effort: Balanced}

[glebedel]

Closing without merging. Aikido already covers secrets, dependencies and GitHub Actions workflow checks, so the gitleaks, osv-scanner and zizmor jobs (and the new Dependabot config added with them) would only duplicate it. Requested by guillaume@stackone.com in Slack. The branch is kept, so this can be reopened if needed.