[cchostak]

🛡️ Automated Security Audit — BlackShield Pipeline Scanner

Hi @cloudbase team 👋

We ran the open BlackShield Pipeline Scanner in an isolated, read-only, network-airgapped sandbox against cloudbase/garm (commit 1fdee99) and identified 5 actionable security finding(s) (0 Critical, 5 High).

💡 You know we could do this in every PR for you, at zero cost.

BlackShield runs unified SAST, SCA/CVE reachability (VEX), Secret Detection, and IaC/Container Misconfiguration checks in a single static binary (<30s runtime) without requiring source code upload.

🔗 Need the full platform? Explore centralized posture management, automated triage, and continuous PR guardrails at https://blackshield.chaplau.com.

📊 Findings Summary by Severity

Severity	Count
🔴 Critical	0
🟠 High	5
🟡 Medium	17
🔵 Low	0

🔍 Top Actionable Findings

Severity	Category	Rule / CVE	Location	Recommended Remediation
HIGH	misconfiguration	CKV_DOCKER_1	Dockerfile:1	Add 'USER ' instruction before container entrypoint.
HIGH	misconfiguration	CKV_DOCKER_1	Dockerfile.build-static:1	Add 'USER ' instruction before container entrypoint.
HIGH	misconfiguration	CKV_DOCKER_1	Dockerfile.build-static:14	Add 'USER 10001' or a dedicated non-root application user.
HIGH	sast	go-sqli-db-query-sprintf	database/sql/migrations/0008_constraint_parity.go:146	Use parameterized database/sql or GORM placeholder queries (?, $1) instead of fmt.Sprintf or string concatenation.
HIGH	sast	go-sqli-db-query-sprintf	database/sql/migrations/0008_constraint_parity.go:151	Use parameterized database/sql or GORM placeholder queries (?, $1) instead of fmt.Sprintf or string concatenation.

📦 What's Included in This PR

1. .security/blackshield-audit-report.md — Detailed remediation guide with file paths, line numbers, CVE fixed versions, and CWE references.
2. .github/workflows/blackshield-security.yml — Drop-in, zero-cost GitHub Actions workflow that runs blackshield/pipeline-scanner on every future Pull Request with least-privilege permissions (contents: read).

🚀 Want Continuous Protection or Centralized Triage?

• Option A (100% Free Standalone CI): Add .github/workflows/blackshield-security.yml (snippet below) to run the open scanner in your own GitHub Actions runner on every PR at zero cost.
• Option B (BlackShield Platform): Visit https://blackshield.chaplau.com if your team needs a unified security dashboard, organization-wide policy exceptions, SARIF/VEX reachability graphs, or Slack/Jira alerting.

📋 Drop-in GitHub Actions Workflow (.github/workflows/blackshield-security.yml)

# Zero-Cost Continuous PR Security Scan powered by BlackShield (https://blackshield.chaplau.com)
name: BlackShield Security Scan

on:
  pull_request:
    branches: [ main, master, develop ]
  push:
    branches: [ main, master ]

permissions:
  contents: read

jobs:
  blackshield-scan:
    name: BlackShield Pipeline Scanner (SAST / SCA / Secrets / IaC)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Run BlackShield Pipeline Scanner (Sandboxed)
        run: |
          mkdir -p .artifacts
          docker run --rm \
            --network=none \
            --read-only \
            --tmpfs /tmp:rw,noexec,nosuid,nodev,size=64m \
            --cap-drop=ALL \
            --security-opt=no-new-privileges:true \
            --pids-limit=64 \
            --memory=512m \
            -v "${GITHUB_WORKSPACE}:/scan:ro" \
            -v "${GITHUB_WORKSPACE}/.artifacts:/artifacts:rw" \
            -e SCAN_TOOL=all \
            -e SCAN_TARGET=/scan \
            -e SCAN_OUTPUT_FILE=/artifacts/pipeline-scan-findings.json \
            -e REPOSITORY_NAME="${GITHUB_REPOSITORY}" \
            -e DISABLE_FEED_REFRESH=true \
            -e SCAN_FAIL_ON=high \
            public.ecr.aws/blackshield-security/pipeline-scanner:1.0.18

---

Generated autonomously inside a network-isolated (--network=none), read-only BlackShield sandbox (https://blackshield.chaplau.com). All potential secret values have been automatically redacted (***REDACTED***).