Shared GitHub Actions reusable security workflows, canonical .gitleaks.toml baseline, and default community health files for github.com/lopes repositories.
.github/workflows/security.yml— Reusable workflow (workflow_call) executing three open-source deterministic checks across all repository paths (includingtests/):gitleaks(v8.30.1) — Full git commit-history secret scan (fetch-depth: 0,--redact). Uses the caller repository's.gitleaks.tomlif present, or falls back to this repository's canonical.gitleaks.toml.opengrep— Open-source multi-language static analysis (python,bash,rust,terraform,yaml/github-actions,generic/secrets) atERRORseverity.trivy(aquasecurity/trivy-action) — Filesystem dependency vulnerability (CRITICAL,HIGHwith available fixes) and IaC misconfiguration scan (Terraform, Ansible, Dockerfiles, GitHub Actions, and lockfiles).
.gitleaks.toml— Canonical secret-scanning ruleset extending Gitleaks defaults with explicit URL query-parameter credential detection (?key=,?api_key=,?token=,?access_token=,?license_key=) and zerotests/exclusions.SECURITY.md— Account-wide default vulnerability disclosure policy inherited automatically by all public repositories undergithub.com/lopesunless overridden locally.
Important
Why maintain an account-owned .github repository instead of calling a third-party workflow?
- Supply-chain containment: Referencing an external vendor's
uses: org/repo/.github/workflows/...@mainacross every public and private repository delegates runner execution andGITHUB_TOKENaccess to a mutable third-party branch. Owninglopes/.githubkeeps version pinning (gitleaks,opengrep,trivy-action,actions/checkout) under direct control while still pulling official upstream binaries and actions. - Fast, focused execution (~25s vs. 5+ min): Multi-linter suites (
super-linter,megalinter) pull multi-gigabyte container images on every run and do not bundleopengrepor account-wide.gitleaks.tomlinheritance. - Single source of truth: Updating a scanner version or adding a custom secret rule in
.gitleaks.tomlhappens in one commit here rather than opening pull requests across every repository, and GitHub only inherits default community health files (SECURITY.md) from<owner>/.github.
Add .github/workflows/security.yml to any repository:
---
name: Security
on:
pull_request:
push:
branches: [main]
schedule:
- cron: "17 4 * * 1"
permissions:
contents: read
security-events: write
jobs:
security:
uses: lopes/.github/.github/workflows/security.yml@main