GitHub Advanced Security: Configuration, Management, and Reporting Guide

# .github/workflows/codeql-analysis.yml
name: "CodeQL Analysis"

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  schedule:
    # Run weekly on Sunday at 4:00 AM UTC
    - cron: '0 4 * * 0'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    timeout-minutes: 360
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'javascript', 'python', 'go' ]
        # Supported languages: cpp, csharp, go, java, javascript, python, ruby, swift

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # Override the default queries with a custom suite
        queries: security-extended,security-and-quality

    # For compiled languages (Java, C++, C#, Go, Swift), add build steps
    # Autobuild attempts to build any compiled language
    - name: Autobuild
      uses: github/codeql-action/autobuild@v3

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{ matrix.language }}"

- name: Initialize CodeQL
  uses: github/codeql-action/init@v3
  with:
    languages: javascript
    queries: security-extended

- name: Initialize CodeQL
  uses: github/codeql-action/init@v3
  with:
    languages: javascript
    packs: |
      codeql/javascript-queries:path/to/custom-queries
      my-org/my-security-queries@1.0.0      

# .github/codeql/codeql-config.yml
name: "Custom CodeQL Config"

# Disable default queries and use custom ones
disable-default-queries: false

# Add custom query packs
packs:
  javascript:
    - codeql/javascript-queries

# Add custom queries from your repository
queries:
  - uses: ./custom-queries/javascript

# Exclude paths from analysis
paths-ignore:
  - '**/test/**'
  - '**/tests/**'
  - '**/node_modules/**'
  - '**/vendor/**'
  - '**/*.test.js'
  - '**/*.spec.js'

# Only analyze specific paths
paths:
  - src
  - lib

- name: Initialize CodeQL
  uses: github/codeql-action/init@v3
  with:
    languages: javascript
    config-file: ./.github/codeql/codeql-config.yml

# Using GitHub CLI to dismiss an alert
gh api repos/{owner}/{repo}/code-scanning/alerts/{alert_number} \
  -X PATCH \
  -f state=dismissed \
  -f dismissed_reason="false positive" \
  -f dismissed_comment="This pattern is safe in our context because..."

# Example: Running ESLint and uploading results
- name: Run ESLint
  run: npx eslint . --format @microsoft/sarif --output-file eslint-results.sarif
  continue-on-error: true

- name: Upload ESLint SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: eslint-results.sarif
    category: eslint

# Using GitHub API to enable secret scanning
gh api orgs/{org}/repos/{repo} \
  -X PATCH \
  -f security_and_analysis.secret_scanning.status=enabled \
  -f security_and_analysis.secret_scanning_push_protection.status=enabled

# When push protection detects a secret, you'll see:
remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: 
remote: - GITHUB_PUSH_PROTECTION: push protection detected a secret in commit abc1234
remote:   Secret type: GitHub Personal Access Token
remote:   Location: config/secrets.js:15
remote:
remote: To push, either remove the secret or use a bypass if you believe this is safe

# Configure custom patterns that are allowed
# In repository Settings → Code security → Secret scanning → Push protection

# Allowed patterns (example for test/mock tokens):
# - Pattern: test_[a-z0-9]{32}
# - Description: Test tokens for CI/CD

# Example custom pattern for internal API keys
Name: Internal API Key
Pattern: INTERNAL_[A-Z0-9]{24}
Description: Detects internal API keys used in our services

# List secret scanning alerts
gh api repos/{owner}/{repo}/secret-scanning/alerts

# Get specific alert details
gh api repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}

# Close an alert
gh api repos/{owner}/{repo}/secret-scanning/alerts/{alert_number} \
  -X PATCH \
  -f state=resolved \
  -f resolution=revoked

# .github/workflows/dependency-review.yml
name: 'Dependency Review'
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout Repository'
        uses: actions/checkout@v4
      
      - name: 'Dependency Review'
        uses: actions/dependency-review-action@v4
        with:
          # Fail on any vulnerability with severity >= high
          fail-on-severity: high
          
          # Also fail on these license types
          deny-licenses: GPL-3.0, AGPL-3.0
          
          # Allow specific packages with known issues
          allow-ghsas: GHSA-xxxx-xxxx-xxxx

- name: 'Dependency Review'
  uses: actions/dependency-review-action@v4
  with:
    # Severity threshold: critical, high, moderate, low
    fail-on-severity: moderate
    
    # License checking
    allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause
    deny-licenses: GPL-3.0, AGPL-3.0, LGPL-3.0
    
    # Scope filtering
    fail-on-scopes: runtime, development
    
    # Vulnerability filtering
    allow-ghsas: GHSA-xxxx-xxxx-xxxx, GHSA-yyyy-yyyy-yyyy
    
    # Output configuration
    comment-summary-in-pr: always

# Export security overview data using GitHub API
gh api orgs/{org}/security-managers

# Get code scanning alerts across org
gh api orgs/{org}/code-scanning/alerts \
  --paginate \
  -q '.[] | [.repository.name, .state, .rule.severity, .rule.description] | @csv'

# Get secret scanning alerts across org
gh api orgs/{org}/secret-scanning/alerts \
  --paginate \
  -q '.[] | [.repository.name, .state, .secret_type] | @csv'

# Code scanning alerts for a repository
GET /repos/{owner}/{repo}/code-scanning/alerts

# Code scanning alerts for an organization
GET /orgs/{org}/code-scanning/alerts

# Secret scanning alerts for a repository
GET /repos/{owner}/{repo}/secret-scanning/alerts

# Secret scanning alerts for an organization
GET /orgs/{org}/secret-scanning/alerts

# Dependabot alerts for a repository
GET /repos/{owner}/{repo}/dependabot/alerts

# Dependabot alerts for an organization
GET /orgs/{org}/dependabot/alerts

# Query code scanning alerts
query {
  repository(owner: "owner", name: "repo") {
    vulnerabilityAlerts(first: 100) {
      nodes {
        createdAt
        dismissedAt
        securityVulnerability {
          severity
          package {
            name
          }
          advisory {
            summary
          }
        }
      }
    }
  }
}

#!/usr/bin/env python3
"""
GitHub Advanced Security Reporting Script
Generates comprehensive security reports across repositories
"""

import os
import json
from datetime import datetime, timedelta
from github import Github
import csv

GITHUB_TOKEN = os.environ.get('GITHUB_TOKEN')
ORG_NAME = "your-organization"

def get_code_scanning_alerts(g, org_name):
    """Fetch code scanning alerts across organization"""
    alerts = []
    org = g.get_organization(org_name)
    
    for repo in org.get_repos():
        try:
            repo_alerts = repo.get_codescan_alerts()
            for alert in repo_alerts:
                alerts.append({
                    'repository': repo.name,
                    'rule_id': alert.rule.id,
                    'rule_description': alert.rule.description,
                    'severity': alert.rule.severity,
                    'state': alert.state,
                    'created_at': alert.created_at.isoformat(),
                    'html_url': alert.html_url
                })
        except Exception as e:
            print(f"Could not fetch alerts for {repo.name}: {e}")
    
    return alerts

def get_secret_scanning_alerts(g, org_name):
    """Fetch secret scanning alerts across organization"""
    alerts = []
    org = g.get_organization(org_name)
    
    for repo in org.get_repos():
        try:
            repo_alerts = repo.get_secret_scanning_alerts()
            for alert in repo_alerts:
                alerts.append({
                    'repository': repo.name,
                    'secret_type': alert.secret_type,
                    'state': alert.state,
                    'created_at': alert.created_at.isoformat(),
                    'resolution': alert.resolution,
                    'html_url': alert.html_url
                })
        except Exception as e:
            print(f"Could not fetch secret alerts for {repo.name}: {e}")
    
    return alerts

def generate_summary_report(code_alerts, secret_alerts):
    """Generate summary statistics"""
    
    # Code scanning summary
    code_by_severity = {}
    code_by_state = {}
    for alert in code_alerts:
        severity = alert['severity']
        state = alert['state']
        code_by_severity[severity] = code_by_severity.get(severity, 0) + 1
        code_by_state[state] = code_by_state.get(state, 0) + 1
    
    # Secret scanning summary
    secret_by_type = {}
    secret_by_state = {}
    for alert in secret_alerts:
        stype = alert['secret_type']
        state = alert['state']
        secret_by_type[stype] = secret_by_type.get(stype, 0) + 1
        secret_by_state[state] = secret_by_state.get(state, 0) + 1
    
    return {
        'generated_at': datetime.now().isoformat(),
        'code_scanning': {
            'total': len(code_alerts),
            'by_severity': code_by_severity,
            'by_state': code_by_state
        },
        'secret_scanning': {
            'total': len(secret_alerts),
            'by_type': secret_by_type,
            'by_state': secret_by_state
        }
    }

def export_to_csv(alerts, filename):
    """Export alerts to CSV"""
    if not alerts:
        return
    
    with open(filename, 'w', newline='') as f:
        writer = csv.DictWriter(f, fieldnames=alerts[0].keys())
        writer.writeheader()
        writer.writerows(alerts)

def main():
    g = Github(GITHUB_TOKEN)
    
    print(f"Generating security report for {ORG_NAME}...")
    
    # Fetch alerts
    code_alerts = get_code_scanning_alerts(g, ORG_NAME)
    secret_alerts = get_secret_scanning_alerts(g, ORG_NAME)
    
    # Generate summary
    summary = generate_summary_report(code_alerts, secret_alerts)
    
    # Export data
    export_to_csv(code_alerts, f'code_scanning_alerts_{datetime.now():%Y%m%d}.csv')
    export_to_csv(secret_alerts, f'secret_scanning_alerts_{datetime.now():%Y%m%d}.csv')
    
    with open(f'security_summary_{datetime.now():%Y%m%d}.json', 'w') as f:
        json.dump(summary, f, indent=2)
    
    # Print summary
    print("\n" + "="*60)
    print("SECURITY REPORT SUMMARY")
    print("="*60)
    print(f"Generated: {summary['generated_at']}")
    print(f"\nCode Scanning Alerts: {summary['code_scanning']['total']}")
    for severity, count in summary['code_scanning']['by_severity'].items():
        print(f"  - {severity}: {count}")
    print(f"\nSecret Scanning Alerts: {summary['secret_scanning']['total']}")
    for state, count in summary['secret_scanning']['by_state'].items():
        print(f"  - {state}: {count}")

if __name__ == "__main__":
    main()

#!/bin/bash
# quick-security-report.sh - Generate security overview using GitHub CLI

ORG="your-organization"
OUTPUT_DIR="./security-reports"
mkdir -p "$OUTPUT_DIR"

echo "GitHub Advanced Security Report"
echo "Organization: $ORG"
echo "Generated: $(date)"
echo "================================"

# Code scanning summary
echo ""
echo "=== Code Scanning Alerts ==="
gh api "orgs/$ORG/code-scanning/alerts?state=open&per_page=100" \
  --jq 'group_by(.rule.severity) | 
        map({severity: .[0].rule.severity, count: length}) | 
        .[] | "\(.severity): \(.count)"'

# Secret scanning summary
echo ""
echo "=== Secret Scanning Alerts ==="
gh api "orgs/$ORG/secret-scanning/alerts?state=open&per_page=100" \
  --jq 'group_by(.secret_type) | 
        map({type: .[0].secret_type, count: length}) | 
        .[] | "\(.type): \(.count)"'

# Repository coverage
echo ""
echo "=== Security Feature Coverage ==="
gh api "orgs/$ORG/repos?per_page=100" \
  --jq '.[] | select(.archived == false) | 
        "\(.name): Code Scanning=\(.security_and_analysis.code_scanning.status // "disabled"), 
        Secret Scanning=\(.security_and_analysis.secret_scanning.status // "disabled")"'

echo ""
echo "Report complete. Detailed data exported to $OUTPUT_DIR"

# .github/workflows/security-report.yml
name: Weekly Security Report

on:
  schedule:
    # Run every Monday at 9 AM UTC
    - cron: '0 9 * * 1'
  workflow_dispatch:

jobs:
  generate-report:
    runs-on: ubuntu-latest
    permissions:
      security-events: read
      contents: write
      
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        
      - name: Generate Security Report
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Create report directory
          mkdir -p reports
          
          # Get code scanning alerts
          gh api "repos/${{ github.repository }}/code-scanning/alerts" \
            --paginate > reports/code-scanning.json
          
          # Get secret scanning alerts  
          gh api "repos/${{ github.repository }}/secret-scanning/alerts" \
            --paginate > reports/secret-scanning.json
          
          # Generate summary
          echo "# Security Report - $(date +%Y-%m-%d)" > reports/summary.md
          echo "" >> reports/summary.md
          echo "## Code Scanning" >> reports/summary.md
          echo "Total alerts: $(jq length reports/code-scanning.json)" >> reports/summary.md
          echo "" >> reports/summary.md
          echo "## Secret Scanning" >> reports/summary.md
          echo "Total alerts: $(jq length reports/secret-scanning.json)" >> reports/summary.md
                    
      - name: Upload Report Artifact
        uses: actions/upload-artifact@v4
        with:
          name: security-report-${{ github.run_number }}
          path: reports/
          
      - name: Send Report to Slack
        if: always()
        uses: slackapi/slack-github-action@v1.24.0
        with:
          payload: |
            {
              "text": "Weekly Security Report Generated",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*Weekly Security Report*\nRepository: ${{ github.repository }}\nGenerated: $(date)"
                  }
                }
              ]
            }            
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 10
    
    # Group security updates together
    groups:
      security-updates:
        applies-to: security-updates
        patterns:
          - "*"
    
    # Auto-merge minor and patch security updates
    allow:
      - dependency-type: "direct"
    
    commit-message:
      prefix: "chore(deps):"
      include: "scope"
      
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"

# .github/workflows/auto-merge-dependabot.yml
name: Auto-merge Dependabot PRs

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: write
  pull-requests: write

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    
    steps:
      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v1
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
          
      - name: Auto-merge patch and minor updates
        if: |
          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
          steps.metadata.outputs.update-type == 'version-update:semver-minor'          
        run: |
          gh pr review --approve "$PR_URL"
          gh pr merge --auto --squash "$PR_URL"          
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

<!-- .github/PULL_REQUEST_TEMPLATE/security_fix.md -->

## Security Fix

### Alert Reference
- Alert URL: 
- Alert Type: [Code Scanning / Secret Scanning / Dependabot]
- Severity: [Critical / High / Medium / Low]

### Changes Made
- [ ] Vulnerability has been fixed
- [ ] No new vulnerabilities introduced
- [ ] Tests pass
- [ ] Documentation updated (if applicable)

### Root Cause
[Describe what caused this vulnerability]

### Fix Description
[Describe how the vulnerability was fixed]

### Testing
- [ ] Existing tests pass
- [ ] New tests added for the fix
- [ ] Manually tested the fix

### Checklist
- [ ] I have read the [security guidelines](link-to-guidelines)
- [ ] This PR follows our security best practices
- [ ] The fix has been reviewed by a security team member

#!/bin/bash
# bulk-dismiss-alerts.sh - Dismiss multiple code scanning alerts

REPO="owner/repo"
REASON="used in tests"
COMMENT="These alerts are in test code and don't affect production"

# Get all open alerts in test directories
ALERTS=$(gh api "repos/$REPO/code-scanning/alerts?state=open&per_page=100" \
  --jq '.[] | select(.most_recent_instance.location.path | test("test|spec|__tests__")) | .number')

for alert_number in $ALERTS; do
  echo "Dismissing alert #$alert_number..."
  gh api "repos/$REPO/code-scanning/alerts/$alert_number" \
    -X PATCH \
    -f state=dismissed \
    -f dismissed_reason="$REASON" \
    -f dismissed_comment="$COMMENT"
done

echo "Done! Dismissed $(echo "$ALERTS" | wc -l) alerts."

<!-- .github/SECURITY.md in your .github repository -->

# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 2.x.x   | :white_check_mark: |
| 1.x.x   | :x:                |

## Reporting a Vulnerability

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

### How to Report

1. **Do not** create a public GitHub issue
2. Email security@yourcompany.com with:
   - Description of the vulnerability
   - Steps to reproduce
   - Potential impact
   - Suggested fix (if any)

### Response Timeline

- **Initial response**: Within 24 hours
- **Status update**: Within 72 hours
- **Resolution target**: 30 days for critical, 90 days for others

### Disclosure Policy

- We will acknowledge receipt within 24 hours
- We will provide regular updates on progress
- We will credit reporters (unless anonymity requested)
- We coordinate disclosure timing with reporters

## Security Features

This organization uses GitHub Advanced Security:

- ✅ Code scanning enabled on all repositories
- ✅ Secret scanning with push protection
- ✅ Dependency review on all pull requests
- ✅ Dependabot security updates enabled

# Using GitHub CLI to configure branch protection
gh api "repos/{owner}/{repo}/branches/main/protection" \
  -X PUT \
  -H "Accept: application/vnd.github+json" \
  -f "required_status_checks[strict]=true" \
  -f "required_status_checks[contexts][]=CodeQL" \
  -f "required_status_checks[contexts][]=dependency-review" \
  -f "required_pull_request_reviews[required_approving_review_count]=1" \
  -f "required_pull_request_reviews[dismiss_stale_reviews]=true" \
  -f "enforce_admins=true" \
  -f "restrictions=null"

# Example ruleset configuration (via UI or API)
name: Security Enforcement
target: branch
enforcement: active
conditions:
  ref_name:
    include:
      - refs/heads/main
      - refs/heads/release/*
rules:
  - type: required_status_checks
    parameters:
      required_status_checks:
        - context: "CodeQL"
          integration_id: 0
        - context: "Dependency Review"
          integration_id: 0
      strict_required_status_checks_policy: true
  - type: pull_request
    parameters:
      required_approving_review_count: 1
      dismiss_stale_reviews_on_push: true
      require_code_owner_review: true

## Alert Triage Workflow

1. **Initial Review** (< 1 hour)
   - Verify alert is legitimate (not false positive)
   - Assess severity and potential impact
   - Assign to appropriate team member

2. **Analysis** (< 1 day)
   - Understand the vulnerability context
   - Determine exploitability
   - Identify affected code paths

3. **Prioritization**
   - Critical: Fix within 24 hours
   - High: Fix within 1 week
   - Medium: Fix within 1 sprint
   - Low: Fix as time permits

4. **Remediation**
   - Create issue/ticket for tracking
   - Develop and test fix
   - Submit PR with security fix template
   - Request security review

5. **Verification**
   - Confirm alert is closed
   - Run regression tests
   - Update documentation if needed

# Recommended maintenance cadence

Weekly:
  - Review new alerts from security overview
  - Triage and assign critical/high severity alerts
  - Check Dependabot PR queue

Monthly:
  - Review security feature coverage
  - Update custom query packs if needed
  - Review dismissed alerts for patterns

Quarterly:
  - Full security posture review
  - Update security policies
  - Review and rotate service account tokens
  - Training refresher for team

Annually:
  - Comprehensive security audit
  - GHAS configuration review
  - Update incident response procedures

# Example PR workflow with security gates
# .github/workflows/pr-security-checks.yml

name: PR Security Checks

on:
  pull_request:
    branches: [main, develop]

jobs:
  security-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Run CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        
      - name: Dependency Review
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: high
          
      - name: Check for Secrets
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          
      - name: Security Summary
        if: always()
        run: |
          echo "## Security Check Summary" >> $GITHUB_STEP_SUMMARY
          echo "- CodeQL: Complete" >> $GITHUB_STEP_SUMMARY
          echo "- Dependency Review: Complete" >> $GITHUB_STEP_SUMMARY
          echo "- Secret Scanning: Complete" >> $GITHUB_STEP_SUMMARY          

# Debug CodeQL analysis
- name: Initialize CodeQL
  uses: github/codeql-action/init@v3
  with:
    languages: javascript
    debug: true

# Exclude test directories
config-file: |
  paths-ignore:
    - '**/test/**'
    - '**/tests/**'
    - '**/__tests__/**'
    - '**/*.test.*'
    - '**/*.spec.*'