ci: scan pull requests for credentials and injection with ThreatCrush

[ralyodio]

Adds one workflow. On each pull request it scans the checked-out repository for
hardcoded credentials, injection, SSRF and unsafe deserialisation, and writes
findings to the Security tab and a comment.

• .github/workflows/threatcrush-scan.yml
• .github/scripts/threatcrush-to-sarif.py — SARIF shim for older CLI versions

Report-only. failOn is empty, so findings never fail the build. An install
or scan failure does fail the job: a scanner that reports clean when it did not
run is worse than no scanner.

Scope: it scans the whole checked-out repository, not only the diff.

Supply chain. Pinned to @profullstack/threatcrush@0.11.0; the tarball is hashed and checked against
a value in the workflow before install (npm view it yourself), installed with
--ignore-scripts, actions pinned to commit SHAs, and it runs on pull_request
rather than pull_request_target.

Asked first in #2734.

Disclosure: I maintain ThreatCrush;
MIT and free. Written with AI assistance. Closing this is a fine answer and I
will not send another.

[greptile-apps]

Greptile Summary

The PR adds a pull-request workflow that installs a pinned ThreatCrush release, scans the checked-out repository, and publishes SARIF results through workflow artifacts, job summaries, code scanning, and same-repository PR comments.

• Verifies the scanner tarball before installing it with lifecycle scripts disabled.
• Separates findings in changed files from the repository-wide backlog.
• Treats missing or incomplete scan output as a failed scan rather than a clean result.

Confidence Score: 4/5

The PR should not merge until SARIF-derived values are escaped before being inserted into the Markdown report.

The previously reported report-rendering defect remains: scanner-controlled paths and rule IDs are interpolated directly into Markdown table cells and code spans, allowing valid delimiters to produce malformed summaries and PR comments.

Files Needing Attention: .github/workflows/threatcrush-scan.yml

Important Files Changed

Filename	Overview
.github/workflows/threatcrush-scan.yml	Adds the complete ThreatCrush installation, scanning, report generation, artifact upload, code-scanning upload, and PR-comment workflow.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  PR[Pull request] --> Checkout[Checkout merge ref]
  Checkout --> Scope[Determine changed files]
  Checkout --> Scan[Run ThreatCrush]
  Scan --> SARIF[SARIF results]
  Scope --> Report[Build scoped Markdown report]
  SARIF --> Report
  SARIF --> Artifact[Upload artifact]
  SARIF --> Security[Upload to Security tab]
  Report --> Summary[Job summary]
  Report --> Comment[PR comment]

Loading

_{Reviews (2): Last reviewed commit: "ci: drop the ThreatCrush SARIF converter..." | Re-trigger Greptile}

[greptile-apps]

Unescaped Markdown table fields

A scanned path containing a pipe or backtick is inserted directly into this Markdown table row, causing the job summary and same-repository PR comment to render shifted or malformed finding columns. Escape Markdown table and code-span delimiters in SARIF-derived values before rendering them.

[UnschooledGamer]

Needs a dedicated approval from Maintainers of the project.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.