feat: Add GitHub Actions CI/CD workflow

[zohayb23]

Adds GitHub Actions CI/CD workflow with automated build, test, security scanning, and multi-platform Docker image publishing.

Workflow runs automatically on push/PR to main or develop.

[kusari-inspector]

Kusari Analysis Results:

Caution

Flagged Issues Detected
These changes contain flagged issues that may introduce security risks.

While dependency analysis found no security issues, code analysis identified 16 high severity security vulnerabilities that pose critical risks. The most concerning issues include dangerous template injection vulnerabilities in GitHub workflows that could enable code injection attacks, overly broad workflow permissions violating least privilege principles, and unpinned GitHub actions creating supply chain risks. These template injection vulnerabilities are particularly severe as they can compromise the entire CI/CD pipeline. The identified security flaws must be remediated before merging to prevent potential code execution attacks and maintain secure deployment practices.

Note

View full detailed analysis result for more information on the output and the checks that were run.

Required Code Mitigations

Move permissions to job level instead of workflow level to follow least privilege principle. Remove workflow-level permissions block.

• Location: .github/workflows/ci-cd.yml:15

• Potential Code Fix:

Remove the entire permissions block at workflow level (lines 14-19) and add specific permissions to individual jobs that need them.

Template injection vulnerability - avoid direct interpolation of GitHub context variables in shell commands

• Location: .github/workflows/ci-cd.yml:202

• Potential Code Fix:

env:
  VERSION: ${{ github.ref_name }}
  COMMIT_HASH: ${{ github.sha }}
run: |
  go build -ldflags="-s -w -X 'main.Version=${VERSION}' -X 'main.GitCommitHash=${COMMIT_HASH}' -X 'main.BuiltAt=$(date -u +%Y-%m-%dT%H:%M:%SZ)'" -o ${{ matrix.output }}

Template injection vulnerability - avoid direct interpolation of repository context in shell commands

• Location: .github/workflows/ci-cd.yml:303

• Potential Code Fix:

env:
  REPO_OWNER: ${{ github.repository_owner }}
  REPO_NAME: ${{ github.event.repository.name }}
run: |
  cat > test-config.yml << EOF
  loglevel: info
  write-directory: evaluation_results
  write: true
  output: yaml
  services:
    self-test:
      plugin: github-repo
      policy:
        catalogs:
          - OSPS_B
        applicability:
          - Maturity Level 1
      vars:
        owner: ${REPO_OWNER}
        repo: ${REPO_NAME}
        token: \${{ secrets.GITHUB_TOKEN }}
  EOF

Add persist-credentials: false to prevent credential persistence

• Location: .github/workflows/ci-cd.yml:284

• Potential Code Fix:

- name: Checkout code
  uses: actions/checkout@v5
  with:
    persist-credentials: false

---

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: f62feac, performed at: 2025-10-28T18:40:01Z

Found this helpful? Give it a 👍 or 👎 reaction!

[kusari-inspector]

Issue: Move permissions to job level instead of workflow level to follow least privilege principle. Remove workflow-level permissions block.

Recommended Code Changes:

Remove the entire permissions block at workflow level (lines 14-19) and add specific permissions to individual jobs that need them.

[kusari-inspector]

Issue: Template injection vulnerability - avoid direct interpolation of GitHub context variables in shell commands

Recommended Code Changes:

env:
  VERSION: ${{ github.ref_name }}
  COMMIT_HASH: ${{ github.sha }}
run: |
  go build -ldflags="-s -w -X 'main.Version=${VERSION}' -X 'main.GitCommitHash=${COMMIT_HASH}' -X 'main.BuiltAt=$(date -u +%Y-%m-%dT%H:%M:%SZ)'" -o ${{ matrix.output }}

[kusari-inspector]

Issue: Template injection vulnerability - avoid direct interpolation of repository context in shell commands

Recommended Code Changes:

env:
  REPO_OWNER: ${{ github.repository_owner }}
  REPO_NAME: ${{ github.event.repository.name }}
run: |
  cat > test-config.yml << EOF
  loglevel: info
  write-directory: evaluation_results
  write: true
  output: yaml
  services:
    self-test:
      plugin: github-repo
      policy:
        catalogs:
          - OSPS_B
        applicability:
          - Maturity Level 1
      vars:
        owner: ${REPO_OWNER}
        repo: ${REPO_NAME}
        token: \${{ secrets.GITHUB_TOKEN }}
  EOF

[kusari-inspector]

Issue: Add persist-credentials: false to prevent credential persistence

Recommended Code Changes:

- name: Checkout code
  uses: actions/checkout@v5
  with:
    persist-credentials: false