CI/CD and Security Scanning

GitHub Actions Workflows

The repository has eight workflows covering build, test, security scanning, and release automation.

.NET Build (.github/workflows/build.yml)

• Purpose: Build and test on every push/PR to main
• Runner: windows-latest
• Steps: Setup .NET 10 → dotnet restore -p:RestoreLockedMode=true → dotnet build → dotnet test
• Tests: 59 unit tests (xUnit + NSubstitute + FluentAssertions)

Release (.github/workflows/release.yml)

• Purpose: Automated dual-architecture release on version tags
• Trigger: Push tag matching v*
• Runner: windows-latest
• Steps:
  1. Setup .NET 10 → dotnet test
  2. Optimized publish for win-x64 and win-x86 (R2R, compression, embedded PDB, deterministic, speed-optimized, locked restore)
  3. Build MSI installers for both architectures via WiX v5
  4. Create .7z archives (LZMA2, max compression) via 7-Zip
  5. Install WinRAR via Chocolatey → create .rar archives (RAR5 with 5% recovery record)
  6. Generate checksums.json with SHA256 hashes for all artifacts
  7. Create GitHub Release with all artifacts and auto-generated release notes
• Tool: softprops/action-gh-release
• Naming: JenkinsAsService_<version>_<arch>.<ext>

CodeQL (.github/workflows/codeql.yml)

• Purpose: Source code vulnerability analysis (C#)
• Tool: github/codeql-action
• Trigger: Push/PR to main, weekly schedule
• Output: Findings in GitHub Security tab

PSScriptAnalyzer (.github/workflows/powershell.yml)

• Purpose: Static analysis of PowerShell code (full ruleset)
• Tool: microsoft/psscriptanalyzer-action
• Output: SARIF uploaded to GitHub Security tab
• Schedule: Sundays at 23:23 UTC

Semgrep (.github/workflows/semgrep.yml)

• Purpose: Pattern-based SAST — vulnerable code patterns, deprecated APIs, common weaknesses
• Tool: semgrep/semgrep-action@v1
• Rules: p/default + p/csharp + p/secrets (community rulesets, no token required)
• Output: SARIF uploaded to GitHub Security tab
• Schedule: Sundays at 04:38 UTC

Gitleaks (.github/workflows/gitleaks.yml)

• Purpose: Secret and credential scanning across full git history
• Tool: gitleaks/gitleaks-action@v3.0.0
• Coverage: fetch-depth: 0 — scans all commits
• Schedule: Sundays at 05:00 UTC

Dependency Review (.github/workflows/dependency-review.yml)

• Purpose: Block PRs that introduce NuGet packages with known CVEs
• Trigger: PRs to main
• Tool: actions/dependency-review-action@v5
• Database: GitHub Advisory Database (GHSA)

Trivy — SCA Full Scan (.github/workflows/osv-scanner.yml)

• Purpose: Full-repo dependency vulnerability scan (post-merge + weekly)
• Trigger: Push to main, weekly schedule (Saturdays 23:28 UTC)
• Tool: aquasecurity/trivy-action
• Databases: NVD + GitHub Advisory + OSV
• Output: SARIF uploaded to GitHub Security tab
• Pattern: Calls trivy-reusable.yml via uses: ./.github/workflows/trivy-reusable.yml

Trivy — Reusable Workflow (.github/workflows/trivy-reusable.yml)

• Trigger: workflow_call with inputs scan-type (default: fs) and scan-ref (default: .)
• Steps: checkout → trivy → upload-sarif (if: always())
• Versioning: actions/checkout@v6, github/codeql-action/upload-sarif@v4, aquasecurity/trivy-action@v0.36.0

Dependabot (.github/dependabot.yml)

Weekly automated PRs for:

• nuget — NuGet package updates
• github-actions — Action version bumps

Security Scanning Stack Summary

Action Versioning Policy

All actions use floating major-version tags — no SHA pins. Rationale: personal/low-risk repo; SHA pins add friction without meaningful supply-chain benefit at this scale.

Codacy / SonarSharp Alert Resolution (Historical)

PR #13 — 211 alerts to 0

Initial alert storm on first push of feature/secret-protection. Key fixes:

PR #14 — 170 alerts to ~147

Two-commit fix sequence addressing S4261 (async suffix), S3994 (Uri params), S134 (nesting depth), S109 (magic numbers), and naming false positives.

Remaining unfixable (~80)

Require Codacy dashboard configuration — not fixable via code:

Security Policy (Security.md)

• Scope: JenkinsAsService executable, MSI installer, CI workflows. Jenkins/JDK/OS/third-party packages are out of scope.
• Supported versions: Latest release only. Older versions are not patched.
• Reporting: GitHub Private Vulnerability Reporting (preferred). No public issues for security bugs.
• Response timeline: Acknowledge in 3 business days, assess in 7, patch within 30 days (critical/high) or 90 days (medium/low).
• Coordinated disclosure: 90-day window, reporter can self-disclose after. Credit offered if desired.
• Bounties: None (volunteer project).

Community Files