Repository navigation
chore(security): add ReversingLabs malware scan workflow - #457
Merged
Merged
Conversation
Contributor
Author
|
@auth0/project-dx-sdks-engineer-codeowner please review the files in the PR. This automated security-hardening workflow is untested in this repo — before merging, confirm it triggers and passes (and is not silently ignoring failures); do not merge on a green result alone. |
Contributor
Author
|
An internal service ticket has been filed for the owning team to review and merge this PR. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #457 +/- ##
=======================================
Coverage 94.52% 94.52%
=======================================
Files 25 25
Lines 2210 2210
=======================================
Hits 2089 2089
Misses 82 82
Partials 39 39 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Package the tracked source as a tar.gz in the reusable rl.yml workflow and scan it with the rl-scan action. Call it from release.yml alongside the release job. A failed scan fails its own run but does not block the release.
ramya18101
approved these changes
Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 Checklist
🔧 Changes
Adds a ReversingLabs malware scan to the release pipeline.
.github/workflows/rl.ymlis a reusable workflow. It packages the tracked source asgo-jwt-middleware-<version>.tar.gzwithgit archive, reading the version from.version, and scans that file with therl-scanaction fromauth0/devsecops-tooling. The job fails unless the scan status issuccess..github/workflows/release.ymlgets a newrl-scanjob that callsrl.ymlon the same trigger as the release job (a mergedrelease/*PR, or a manual dispatch). The release job does not depend on it, so a failed scan fails its own job but does not block the release.The scan needs the eight RL and ProdSec org secrets to be available to this repository, and the AWS role behind
PRODSEC_TOOLS_ARNmust trust it.🔬 Testing
This has not run end to end yet, because it needs the org secrets and the AWS trust for this repository. It runs on the next release or a manual dispatch of the release workflow.