Skip to content

Add reusable security workflow using ScopeGuardian v0.0.1#27

Merged
Nitr4x merged 12 commits into
mainfrom
copilot/create-security-workflow
Apr 11, 2026
Merged

Add reusable security workflow using ScopeGuardian v0.0.1#27
Nitr4x merged 12 commits into
mainfrom
copilot/create-security-workflow

Conversation

Copilot AI commented Apr 11, 2026

Copy link
Copy Markdown
Contributor
  • Dockerfile – pin apk packages in all builder stages (lines 18, 34, 56, 72) using Alpine 3.23 versions
  • Dockerfile – add non-root USER scopeguardian to final runtime stage
  • Dockerfile – add HEALTHCHECK NONE to final runtime stage
  • docker-compose.yml – add security_opt: [no-new-privileges:true], read_only: true, and tmpfs to every service (postgres, redis, initializer, uwsgi, celeryworker, celerybeat, nginx)
  • exec/exec.go – validate binaryPath is an absolute path before passing to exec.Command

nitrax added 2 commits April 11, 2026 16:18
@Nitr4x Nitr4x marked this pull request as ready for review April 11, 2026 14:26
@Nitr4x Nitr4x merged commit fbda60d into main Apr 11, 2026
2 checks passed
@Nitr4x Nitr4x deleted the copilot/create-security-workflow branch April 11, 2026 14:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants