Skip to content

Commit fb322ea

Browse files
Copilotsitoader
Copilot
and
sitoader
authored
feat: add security review workflow with Copilot CLI
Agent-Logs-Url: https://github.com/sitoader/agentic-workflows-copilot-cli/sessions/f3bb15c7-5d78-4d7b-8903-f1e902534f07 Co-authored-by: sitoader <62118837+sitoader@users.noreply.github.com>
1 parent 815d627 commit fb322ea

4 files changed

Lines changed: 320 additions & 0 deletions

File tree

‎.github/prompts/analyze-for-security.prompt.md‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
# Analyze Commit for Security Issues
2+
3+
Analyze commit `{COMMIT_SHA}` in repository `{REPOSITORY}` using the GitHub MCP server to identify security vulnerabilities, insecure coding patterns, or exposed secrets.
4+
5+
## Your Task
6+
7+
1. **Examine the commit** using MCP to access:
8+
- Commit diff and all changed files
9+
- Existing codebase context
10+
- Project structure and dependencies
11+
12+
2. **Identify security concerns** - Look for:
13+
- Hardcoded secrets, API keys, tokens, or passwords
14+
- SQL injection or NoSQL injection vulnerabilities
15+
- Cross-site scripting (XSS) vulnerabilities
16+
- Insecure deserialization
17+
- Missing input validation or sanitization
18+
- Exposed sensitive data in logs or responses
19+
- Insecure direct object references (IDOR)
20+
- Missing or weak authentication/authorization checks
21+
- Use of known-vulnerable libraries or functions
22+
- Insecure cryptographic practices (weak algorithms, hardcoded IVs/salts)
23+
- Path traversal or directory traversal vulnerabilities
24+
- Command injection or OS command execution risks
25+
- Insecure file uploads
26+
- Missing rate limiting on sensitive endpoints
27+
- CORS misconfiguration
28+
- Insecure dependencies introduced (if lockfile or manifest changed)
29+
30+
3. **Evaluate each finding** using a severity scale:
31+
32+
| Severity | Description |
33+
|----------|-------------|
34+
| 🔴 Critical | Immediate exploitation risk (e.g., exposed credentials, RCE) |
35+
| 🟠 High | Likely exploitable (e.g., SQL injection, auth bypass) |
36+
| 🟡 Medium | Exploitable under certain conditions (e.g., XSS, IDOR) |
37+
| 🔵 Low | Best-practice violation with limited impact |
38+
39+
4. **Calculate a confidence score** (0-100) for whether a security issue requires attention:
40+
- 80-100: Critical or high-severity findings — immediate action required
41+
- 60-79: Medium-severity findings — action recommended
42+
- 40-59: Low-severity findings — action optional
43+
- 0-39: No meaningful security concerns detected
44+
45+
### ✅ Flag These:
46+
- Any hardcoded credential or secret value
47+
- User-controlled data passed to queries, shell commands, or file paths without sanitization
48+
- Authentication or authorization logic that could be bypassed
49+
- New dependencies with known CVEs
50+
- Sensitive data returned to clients without redaction
51+
- Security-relevant configuration that is weakened (e.g., disabling TLS verification)
52+
53+
### ❌ Skip These:
54+
- Pure documentation or comment changes
55+
- Test files using clearly fake/mock credentials
56+
- Formatting or whitespace changes
57+
- Changes that are entirely unrelated to security
58+
59+
5. **If security concerns are found (score >= 60):**
60+
61+
Create a GitHub issue using MCP with:
62+
63+
**Title:** `🔒 Security review needed for: [brief description of changes]`
64+
65+
**Body should include:**
66+
```markdown
67+
## Security Review Analysis
68+
69+
**Commit:** {COMMIT_SHA}
70+
**Confidence Score:** [X]/100
71+
72+
### Findings
73+
74+
| Severity | File | Line(s) | Description |
75+
|----------|------|---------|-------------|
76+
| 🔴 Critical | `path/to/file.ext` | 42 | Hardcoded API key detected |
77+
| 🟠 High | `path/to/file.ext` | 87-92 | Unsanitized user input passed to query |
78+
79+
### Detailed Findings
80+
81+
#### Finding 1 – [Short Title]
82+
83+
**Severity:** [Critical / High / Medium / Low]
84+
**File:** `path/to/file.ext` (line [N])
85+
86+
**Issue:**
87+
[Describe what the problem is and why it is a security risk.]
88+
89+
**Recommendation:**
90+
[Describe the fix or mitigation needed.]
91+
92+
---
93+
94+
### Why This Needs Attention
95+
96+
[Summarize the overall risk introduced by these changes.]
97+
98+
---
99+
*Auto-generated by security review workflow*
100+
```
101+
102+
- Add labels: `security`, `automated`
103+
- Use assign_copilot_to_issue tool to assign @copilot to the issue
104+
105+
6. **If no security concerns are found (score < 60):**
106+
- Provide a brief explanation of why no action is needed
107+
- No issue creation required
108+
109+
## Important Guidelines
110+
111+
- Be language-agnostic — detect the language from file extensions
112+
- Do NOT flag test fixtures or mock data that use clearly fake values (e.g., `password: "test123"` inside a unit test helper)
113+
- Prioritize real, exploitable vulnerabilities over theoretical or highly unlikely ones
114+
- Include the specific line or code snippet in your finding description where possible
115+
- Be specific about WHAT should be fixed and HOW, not just that something looks risky

‎.github/workflows/security-review.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Security Review with Copilot
2+
3+
on:
4+
push:
5+
paths-ignore:
6+
- 'docs/**'
7+
- '**.md'
8+
- '.github/workflows/**'
9+
- '.gitignore'
10+
- 'LICENSE'
11+
12+
jobs:
13+
security-review:
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
17+
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@v4
21+
with:
22+
fetch-depth: 0
23+
24+
- name: Install GitHub Copilot CLI
25+
env:
26+
GH_TOKEN: ${{ secrets.COPILOT_CLI_TOKEN }}
27+
run: |
28+
curl -fsSL https://gh.io/copilot-install | bash
29+
echo "Installed Copilot CLI version:"
30+
copilot --version
31+
32+
- name: Analyze and review security with Copilot
33+
env:
34+
GH_TOKEN: ${{ secrets.COPILOT_CLI_TOKEN }}
35+
run: |
36+
echo "Analyzing commit ${{ github.sha }} for security issues..."
37+
echo ""
38+
39+
# Load the prompt template
40+
PROMPT=$(cat .github/prompts/analyze-for-security.prompt.md)
41+
PROMPT="${PROMPT//\{COMMIT_SHA\}/${{ github.sha }}}"
42+
PROMPT="${PROMPT//\{REPOSITORY\}/${{ github.repository }}}"
43+
44+
echo "Delegating to GitHub Copilot for security analysis..."
45+
echo "- Copilot will examine the commit diff"
46+
echo "- Copilot will check for security vulnerabilities and risky patterns"
47+
echo "- Copilot will create an issue if security concerns are found"
48+
echo ""
49+
50+
copilot -p "$PROMPT" --enable-all-github-mcp-tools --allow-all-tools --no-ask-user

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ Agentic workflows with GitHub Actions & Copilot: generate-docs, generate-tests,
88
|----------|---------|-------------|
99
| [Generate Docs](docs/workflows/generate-docs.md) | Push | Analyzes commits and creates documentation issues |
1010
| [Generate Tests](docs/workflows/generate-tests.md) | Push | Identifies missing unit tests and creates issues |
11+
| [Security Review](docs/workflows/security-review.md) | Push | Scans commits for vulnerabilities and creates issues |
1112

1213
---
1314

‎docs/workflows/security-review.md‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
# Security Review Workflow
2+
3+
**Workflow File**: [`.github/workflows/security-review.yml`](../../.github/workflows/security-review.yml)
4+
5+
This workflow analyzes commits for security vulnerabilities, insecure coding patterns, and exposed secrets, then automatically creates issues for Copilot to remediate.
6+
7+
8+
## Overview
9+
10+
The Security Review workflow uses GitHub Copilot CLI to examine code changes and identify security concerns before they reach production. By automating security analysis on every push, teams can catch vulnerabilities early without relying solely on manual code review or scheduled scans.
11+
12+
13+
## How It Works
14+
15+
```mermaid
16+
flowchart TD
17+
A[Push to Repository] --> B{Source files changed?}
18+
B -->|No| C[Skip workflow]
19+
B -->|Yes| D[Install Copilot CLI]
20+
D --> E[Load analyze-security prompt]
21+
E --> F[Copilot analyzes commit diff]
22+
F --> G{Security issues found?}
23+
G -->|No| H[Exit - No concerns found]
24+
G -->|Yes| I[Create GitHub Issue]
25+
I --> J[Assign Copilot Coding Agent]
26+
J --> K[Agent implements fixes]
27+
K --> L[PR created with remediations]
28+
```
29+
30+
### Step-by-Step Process
31+
32+
1. **Triggers on every push** (excluding docs, markdown, and workflow files)
33+
2. **Installs Copilot CLI** in the GitHub Actions runner
34+
3. **Loads the analyze-for-security prompt** from [`.github/prompts/analyze-for-security.prompt.md`](../../.github/prompts/analyze-for-security.prompt.md)
35+
4. **Copilot examines the commit diff** using MCP tools
36+
5. **If security concerns are found** → Creates a GitHub issue and assigns Copilot
37+
6. **Copilot Coding Agent** then implements the remediations
38+
39+
40+
## Criteria for Security Review
41+
42+
### ✅ Issues ARE Flagged
43+
44+
| Category | Examples |
45+
|----------|---------|
46+
| Exposed Credentials | Hardcoded API keys, tokens, passwords |
47+
| Injection Vulnerabilities | SQL injection, command injection, path traversal |
48+
| Insecure Input Handling | Missing validation/sanitization on user input |
49+
| Auth/Authz Weaknesses | Missing auth checks, privilege escalation risks |
50+
| Insecure Cryptography | Weak algorithms, hardcoded IVs or salts |
51+
| Sensitive Data Exposure | Logging PII, returning secrets in API responses |
52+
| Dependency Risks | New dependencies with known CVEs |
53+
| Configuration Weaknesses | Disabled TLS verification, permissive CORS |
54+
55+
### ❌ Issues NOT Flagged
56+
57+
| Category | Examples |
58+
|----------|---------|
59+
| Documentation Only | README, comments, JSDoc |
60+
| Mock/Fake Credentials in Tests | `password: "fake-test-value"` in test helpers |
61+
| Formatting Changes | Whitespace, linting fixes |
62+
| Unrelated Logic Changes | UI tweaks, dependency version bumps with no CVE |
63+
64+
65+
## Configuration
66+
67+
### Trigger Configuration
68+
69+
The workflow runs on source code changes:
70+
71+
```yaml
72+
on:
73+
push:
74+
paths-ignore:
75+
- 'docs/**'
76+
- '**.md'
77+
- '.github/workflows/**'
78+
- '.gitignore'
79+
- 'LICENSE'
80+
```
81+
82+
### Required Secrets
83+
84+
| Secret | Description |
85+
|--------|-------------|
86+
| `COPILOT_CLI_TOKEN` | Personal Access Token with Copilot permissions |
87+
88+
89+
## Prompt File
90+
91+
The workflow uses a specialized prompt to guide Copilot's security analysis:
92+
93+
**Location**: [`.github/prompts/analyze-for-security.prompt.md`](../../.github/prompts/analyze-for-security.prompt.md)
94+
95+
This prompt instructs Copilot to:
96+
- Analyze the git diff for security anti-patterns and vulnerabilities
97+
- Assign a severity level (Critical / High / Medium / Low) to each finding
98+
- Calculate a confidence score to filter out low-signal noise
99+
- Create a structured issue with actionable remediation guidance
100+
101+
102+
## Example Issue Created
103+
104+
When the workflow detects security concerns, it creates an issue like:
105+
106+
```markdown
107+
## 🔒 Security Review Analysis
108+
109+
**Commit**: abc1234
110+
**Confidence Score**: 92/100
111+
112+
### Findings
113+
114+
| Severity | File | Line(s) | Description |
115+
|----------|------|---------|-------------|
116+
| 🔴 Critical | `src/config.ts` | 12 | Hardcoded AWS secret key |
117+
| 🟠 High | `src/routes/user.ts` | 55-60 | Unsanitized user ID passed to SQL query |
118+
119+
### Detailed Findings
120+
121+
#### Finding 1 – Hardcoded AWS Secret Key
122+
123+
**Severity:** Critical
124+
**File:** `src/config.ts` (line 12)
125+
126+
**Issue:**
127+
An AWS secret access key is committed in plain text, exposing the credential to anyone with repository access.
128+
129+
**Recommendation:**
130+
Remove the hardcoded value, rotate the exposed key immediately, and load it from an environment variable or secrets manager.
131+
132+
---
133+
*Auto-generated by security review workflow*
134+
```
135+
136+
137+
## Troubleshooting
138+
139+
### Workflow Not Triggering
140+
141+
- Verify the push includes files outside the `paths-ignore` patterns
142+
- Check that the workflow file exists in the default branch
143+
144+
### Copilot Not Creating Issues
145+
146+
- Ensure `COPILOT_CLI_TOKEN` secret is configured
147+
- Verify the token has `Copilot Requests` permission
148+
- Check workflow logs for authentication errors
149+
150+
### Agent Not Implementing Fixes
151+
152+
- Confirm Copilot Coding Agent is enabled in repository settings
153+
- Verify the issue is properly assigned to `@copilot`
154+
- Review the issue body to ensure findings are clearly described

0 commit comments

Comments
 (0)